Syslog Message Packet Capture

This packet capture contains a single syslog message from a Cisco router to a syslog server. The router logs %LINK-5-CHANGED: Interface Loopback1, changed state to administratively down, and the whole message travels as plain text in one UDP packet.

The only binary-looking part is a number at the very start, <189>, and it holds both the facility and the severity. The Cisco IOS syslog messages lesson covers logging configuration, and syslog severity levels explains the eight levels. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packet walkthrough

The syslog message (packet 1)

Internet Protocol Version 4, Src: 192.168.12.1, Dst: 192.168.12.2
User Datagram Protocol, Src Port: 65085, Dst Port: 514
Syslog message: LOCAL7.NOTICE: 71: *Oct 29 14:32:59.195: %LINK-5-CHANGED: Interface Loopback1, changed state to administratively down
    .... ..00 1011 1... = Facility: LOCAL7 - reserved for local use (23)
    .... .... .... .101 = Level: NOTICE - normal but significant condition (5)
    Message: 71: *Oct 29 14:32:59.195: %LINK-5-CHANGED: Interface Loopback1, changed state to administratively down

This is the raw UDP payload, exactly as it was sent:

<189>71: *Oct 29 14:32:59.195: %LINK-5-CHANGED: Interface Loopback1, changed state to administratively down

Here’s what this packet tells us:

• UDP 514: the standard syslog port. There’s no acknowledgment and no retransmission: if the packet is lost, so is the log message.
• <189>, the PRI value: facility × 8 + severity. 189 = 23 × 8 + 5, so facility 23 (local7) and severity 5 (notice). Wireshark decodes it for you in the Facility and Level lines. local7 is the Cisco IOS default facility.
• 71: the message sequence number. Cisco adds it with service sequence-numbers, so you can spot missing messages at the server.
• *Oct 29 14:32:59.195: the router’s timestamp, with milliseconds. The asterisk means the router’s clock isn’t synchronized (no NTP), so don’t trust this time too much.
• %LINK-5-CHANGED: the Cisco message format is facility-severity-mnemonic. The 5 in the middle is the same severity as in the PRI value.