1

I want to confirm through scanning means if the switch is sending syslog packets or not. What i did was run a nmap scan

    nmap -sV -p514 xxx.xx.xx.xx

The result came out as closed. Does this mean that syslog service is not activated on the switch is this a correct assumption?

2
  • The only way to know is to test. May 11, 2012 at 19:55
  • 1
    Basic TCP/IP knowledge is understanding of listening ports and source and destination ports as well as TCP v. UDP. This question lacks that foundation. You cannot "confirm through scanning" any kind of sending of packets.
    – jrwren
    May 17, 2012 at 19:53

2 Answers 2

1

The port would only be open if the switch was receiving syslog messages from another system. Outgoing connections will not show up in an nmap scan. You could run wireshark to monitor outgoing traffic.

2

I'm sorry to say that @Don Simon is wrong too.

Syslog defaults to udp which will not show up on a nmap -sV scan. syslog over tcp is a rather new implementation and most network gear will not use it.

If you would like to detect the syslog packets, you could sniff your network traffic between the switch and your remote syslog server. You will see UDP packets with a destination port of 514.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .