I've noticed on my CentOS 5.x system that outbound syslog traffic (UDP) doesn't show up in lsof or netstat results.

I've even tried stuff like watch -n .1 'netstat -l -u -n --program' to make sure I don't miss it. Nada.

Yet I do see the traffic when running tcpdump port 514 -s 0 -vvv

Why is that?

  • 3
    514 is the destination port, if it's outbound it's probably using something else as a source port. – Bratchley Jan 16 '15 at 20:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.