Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I want to confirm through scanning means if the switch is sending syslog packets or not. What i did was run a nmap scan 

    nmap -sV -p514 xxx.xx.xx.xx

The result came out as closed. Does this mean that syslog service is not activated on the switch is this a correct assumption?

share|improve this question
The only way to know is to test. – David Schwartz May 11 '12 at 19:55
1  
Basic TCP/IP knowledge is understanding of listening ports and source and destination ports as well as TCP v. UDP. This question lacks that foundation. You cannot "confirm through scanning" any kind of sending of packets. – jrwren May 17 '12 at 19:53

2 Answers

up vote 1 down vote accepted

The port would only be open if the switch was receiving syslog messages from another system. Outgoing connections will not show up in an nmap scan. You could run wireshark to monitor outgoing traffic.

share|improve this answer
up vote 2 down vote

I'm sorry to say that @Don Simon is wrong too.

Syslog defaults to udp which will not show up on a nmap -sV scan. syslog over tcp is a rather new implementation and most network gear will not use it.

If you would like to detect the syslog packets, you could sniff your network traffic between the switch and your remote syslog server. You will see UDP packets with a destination port of 514.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.