Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to confirm through scanning means if the switch is sending syslog packets or not. What i did was run a nmap scan

    nmap -sV -p514 xxx.xx.xx.xx

The result came out as closed. Does this mean that syslog service is not activated on the switch is this a correct assumption?

share|improve this question
    
The only way to know is to test. –  David Schwartz May 11 '12 at 19:55
1  
Basic TCP/IP knowledge is understanding of listening ports and source and destination ports as well as TCP v. UDP. This question lacks that foundation. You cannot "confirm through scanning" any kind of sending of packets. –  jrwren May 17 '12 at 19:53

2 Answers 2

up vote 1 down vote accepted

The port would only be open if the switch was receiving syslog messages from another system. Outgoing connections will not show up in an nmap scan. You could run wireshark to monitor outgoing traffic.

share|improve this answer

I'm sorry to say that @Don Simon is wrong too.

Syslog defaults to udp which will not show up on a nmap -sV scan. syslog over tcp is a rather new implementation and most network gear will not use it.

If you would like to detect the syslog packets, you could sniff your network traffic between the switch and your remote syslog server. You will see UDP packets with a destination port of 514.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.