oss-sec mailing list archives
Re: Syslog forwarding with IP spoofing
From: Solar Designer <solar () openwall com>
Date: Tue, 1 Aug 2017 19:06:37 +0200
Hi all, On Tue, Aug 01, 2017 at 05:27:26PM +0300, Александр Носарев wrote:
I need to recive syslog messages, filter them and send them forward to the SIEM. Also HOST field is not represented in syslog, so i need to spoof IP of forwarding packets to bind messages recived by SIEM to it's original source IP. If i will try to add some marks to syslog message, I will need to override parsers for each syslog source type, so it seems like abad idea. Is there any open source tool for that task?
Somehow we almost didn't have this sort of messages - someone seeking an open source security tool - sent in here so far. Do we want them in here going forward? The current list content guidelines do not address this possibility, as it certainly wasn't the purpose of the oss-security list so far. Is there another mailing list where the above message would have been more appropriate? http://oss-security.openwall.org/wiki/mailing-lists/oss-security#list-content-guidelines Meanwhile, please feel free to address the actual question about the tool. (I don't know of such a tool.) Alexander
Current thread:
- Syslog forwarding with IP spoofing Александр Носарев (Aug 01)
- Re: Syslog forwarding with IP spoofing Solar Designer (Aug 01)
- Re: Syslog forwarding with IP spoofing Mikhail Utin (Aug 01)
- Re: Syslog forwarding with IP spoofing Kurt Seifried (Aug 01)
- Re: Syslog forwarding with IP spoofing Mikhail Utin (Aug 01)
- Re: Syslog forwarding with IP spoofing Sean Cassidy (Aug 01)
- Re: Syslog forwarding with IP spoofing Solar Designer (Aug 01)