Syslog relay with Scapy
I needed to point some syslog data at a new toy being evaluated by security folks.Reconfiguring the logging sources to know about the new device would have been too much of a hassle for a quick test. Reconfiguring the Real Log Server (an rsyslog box) to relay the logs wasn't viable because the source IP in the syslog packets would have reflected the syslog box instead of the origin server.
A few lines of python running on the existing rsyslog box did the trick:
#!/usr/bin/env python2.7
from scapy.all import *
def pkt_callback(pkt):
del pkt[Ether].src
del pkt[Ether].dst
del pkt[IP].chksum
del pkt[UDP].chksum
pkt[IP].dst = '192.168.100.100'
sendp(pkt)
sniff(iface='eth0', filter='udp port 514', prn=pkt_callback, store=0)
This script has scapy collecting frames matching udp port 514 (libpcap filter) from interface eth0. Each matching packet is handed off to the pkt_callback function. It clears fields which need to be recalculated, changes the destination IP (to the address of the new Security Thing) and puts the packets back onto the wire.
The source IP on these forged packets is unchanged, so the Security Thing thinks it's getting the original logs from real servers/routers/switches/PDUs/weather stations/printers/etc... around the Continue reading
The company says it plans to evolve Swarm but hasn't provided any details.
Telstra and Ericsson complete 5G data call; SoftBank increases stake in Sprint; Edgecore Networks contributes hardware for white box packet transponder to TIP.
This is targeted to the data center use case.
The company's SD-WAN service is powered by Cisco Meraki.
