Why do Syslog per udp show in tcpdump

zhjim · 09-13-2013, 03:49 AM

Hi folks,

while trying to find out if a bridge would pass all traffic to all vhost behind it I observed some to me strangeness while sniffing the traffic. Using tcpdump with promiscmode enable I see some udp packages on the syslog port. What I wonder is that it is direct traffic and should not leave the switch or beeing passed on. I would assume I either see all or none. So maybe anyone of you has an idea why I only see this special ones.

Code:

09:42:07.583441 IP 10.10.10.1.514 > 10.10.10.22.514: SYSLOG local2.info, length: 122
09:42:07.621802 IP 10.10.10.1.514 > 10.10.10.22.514: SYSLOG local4.info, length: 111
09:42:07.622613 ARP, Request who-has 10.10.10.10 tell 10.10.10.1, length 46
09:42:07.622640 ARP, Request who-has 10.10.10.11 tell 10.10.10.1, length 46
09:42:07.623071 ARP, Request who-has 10.10.10.20 tell 10.10.10.1, length 46
09:42:07.626555 IP 10.10.10.1.514 > 10.10.10.22.514: SYSLOG local4.info, length: 114
09:42:09.019022 IP 10.10.10.1.514 > 10.10.10.22.514: SYSLOG local0.info, length: 111
09:42:09.293367 IP 10.10.10.1.514 > 10.10.10.22.514: SYSLOG local2.info, length: 122
09:42:09.295084 IP 10.10.10.1.514 > 10.10.10.22.514: SYSLOG local2.info, length: 122

unSpawn · 09-14-2013, 08:19 AM

Determine which host(s) are configured for remote syslogging and what host they log to.

zhjim · 09-16-2013, 05:39 AM

They origin from 10.10.10.1 the gateway for this network and going to 10.10.10.22. I have no access to 10.10.10.22 so can't tell if all is well there. I rechecked the configuration of the gateway which has unicast the syslog messages to 10.10.10.22...

I'm just astouned that normal udp traffic are visible while normal http to a virtual webserver is not shown within the tcpdump session of another virtual guest on the same KVM Host.

As far as I know all the switches in use are dump ones so no configuration possible. Also I'm not aware of any switch option that would broadcast | forward specific protocols. Speaking emulate promisc mode.

cospengle · 09-17-2013, 11:03 AM

If the switch has never seen packets from 10.10.10.22 (quite likely if it is not connected) then it would not know which interface to send the packet out on. So it would flood the packets out of all interfaces on that vlan.

That's one explaination anyway. Could be another reason...

zhjim · 09-18-2013, 02:47 AM

Quote:

Originally Posted by cospengle

If the switch has never seen packets from 10.10.10.22 (quite likely if it is not connected) then it would not know which interface to send the packet out on. So it would flood the packets out of all interfaces on that vlan.

That sounds reasonable. I see that I can get someone to check on .22 and see if all is good there. Thanks for the hint.