Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My company is trying to export the live captured packet syslogs to a device within the network. We were just wondering if it is actually possible to do it with the Wireshark acting as a syslog relay server? Thanks.

share|improve this question
    
Not sure I understand. Are you trying to monitor what data is being sent to/from a syslog device? The .pcap file format is actually a generic capture format - you can do a capture on any device using any software and load it in Wireshark and it will be able to read it fine. –  Mark Henderson Aug 30 '10 at 2:49
    
Please refer to my comment below. Thanks. –  VMNoob Aug 30 '10 at 2:52
    
I have two questions - 1 do you need to do this in real time ? 2 if answer to one is yes, then why not capture the packets on the machine your relaying them to ? –  Geraint Jones Aug 30 '10 at 3:56
    
Cause it will defeat the whole purpose of setting up a network infrastructure.... –  VMNoob Aug 31 '10 at 2:56

1 Answer 1

up vote 1 down vote accepted

Wireshark syslogs? Do you mean the standard wireshark packet captures? If so, I don't know of any easy way to stream those messages to another server.

Have you considered using tcpdump instead? That's what wireshark uses under the hood, and it's a command-line program. This would make it quite easy to run tcpdump remotely via ssh and save the output to a file on the local system.

share|improve this answer
    
Yea I was referring to the packet Captures as we were thinking of transfering real time packet captures to another syslog server etc. Kiwi Server. Thanks. –  VMNoob Aug 30 '10 at 2:51
    
something like this on the destination server netcat -l 3030 | tcpdump -r - and this on the source server tcpdump -w - | netcat destserver 3030 would stream it, but I fail to see the point. –  Geraint Jones Aug 30 '10 at 4:26
    
@c10k You're going to end up with some serious recursion issues there. –  EEAA Aug 30 '10 at 5:04
    
for sure, I had not put any filtering in the tcpdump -w - but you get the idea ;-) –  Geraint Jones Aug 30 '10 at 5:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.