I want to confirm through scanning means if the switch is sending syslog packets or not. What i did was run a nmap scan

    nmap -sV -p514 xxx.xx.xx.xx

The result came out as closed. Does this mean that syslog service is not activated on the switch is this a correct assumption?

  • The only way to know is to test. – David Schwartz May 11 '12 at 19:55
  • 1
    Basic TCP/IP knowledge is understanding of listening ports and source and destination ports as well as TCP v. UDP. This question lacks that foundation. You cannot "confirm through scanning" any kind of sending of packets. – jrwren May 17 '12 at 19:53

The port would only be open if the switch was receiving syslog messages from another system. Outgoing connections will not show up in an nmap scan. You could run wireshark to monitor outgoing traffic.


I'm sorry to say that @Don Simon is wrong too.

Syslog defaults to udp which will not show up on a nmap -sV scan. syslog over tcp is a rather new implementation and most network gear will not use it.

If you would like to detect the syslog packets, you could sniff your network traffic between the switch and your remote syslog server. You will see UDP packets with a destination port of 514.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.