topic PREROUTED 514 traffic not being seen by Splunk in Security

PREROUTED 514 traffic not being seen by Splunk

robnewman666 — Wed, 15 Feb 2017 09:05:13 GMT

I have set up a port redirect using iptables -t nat -A PREROUTING -p UDP -m udp --dport 514 -j REDIRECT --to-ports 5140 and I can see the traffic hitting my em3 port using tcpdump, plus I have set up the port to listen for UDP traffic in Splunk, but nothing shows up within Splunk (indexes etc). I have made this work before using this method, but it isn't today and its bugging me - any ideas why it's not?

Re: PREROUTED 514 traffic not being seen by Splunk

TiagoTLD1 — Wed, 15 Feb 2017 11:50:46 GMT

Hi,

Check index=_internal for the connection from the por you are expecting. If data is really hitting splunk, some message will show up there about it.

Let me know once you have results

Re: PREROUTED 514 traffic not being seen by Splunk

robnewman666 — Wed, 15 Feb 2017 15:48:54 GMT

so i configured an inputs.conf with the following:
[udp://5140]
sourcetype=syslog
connection_host=ip
queueSize = 1MB
persistentQueueSize = 5MB

Now I can see traffic going to port 5140 via index=_internal, but the host is showing as localhost=localdomain, not the ip address I would usually expect.

Re: PREROUTED 514 traffic not being seen by Splunk

TiagoTLD1 — Wed, 15 Feb 2017 15:57:01 GMT

In your inputs.conf you are not specifying any index, so I would check index=main to see if the data is arriving there.

Re: PREROUTED 514 traffic not being seen by Splunk

robnewman666 — Tue, 21 Feb 2017 17:25:02 GMT

Thanks, will try this tomorrow to see if it works.