topic UDP and the 1472 bytes limit in Getting Data In

topic UDP and the 1472 bytes limit in Getting Data In https://community.splunk.com/t5/Getting-Data-In/UDP-and-the-1472-bytes-limit/m-p/621906#M107073 <P>We are receiving syslog data via UDP and we noticed that some data is missing.</P><P>When running - </P><LI-CODE lang="markup">tcpdump -i eth0 port <udp port></LI-CODE><P>I see lines such as - </P><LI-CODE lang="markup">UDP, bad length 5158 > 1472</LI-CODE><P><BR />And the data is not being ingested. <BR /><BR /><A title="tcpdump output with bad length indicator present" href="https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnetworkengineering.stackexchange.com%2Fquestions%2F74563%2Ftcpdump-output-with-bad-length-indicator-present&data=05%7C01%7CDan.Drillich%40ey.com%7Cdd747e3eb5df4e69f41f08daccba043e%7C5b973f9977df4bebb27daa0c70b8482c%7C0%7C0%7C638047396551230716%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=rM9Xbj7iD2jaOFqjWl3ZyzwUr9rJB0i5v0A7nRS9suE%3D&reserved=0" target="_self">https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnetworkengineering.stackexchange.com%2Fquestions%2F74563%2Ftcpdump-output-with-bad-length-indicator-present&data=05%7C01%7CDan.Drillich%40ey.com%7Cdd747e3eb5df4e69f41f08daccba043e%7C5b973f9977df4bebb27daa0c70b8482c%7C0%7C0%7C638047396551230716%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=rM9Xbj7iD2jaOFqjWl3ZyzwUr9rJB0i5v0A7nRS9suE%3D&reserved=0</A>   says - <BR /><BR /></P><P>The 1472 is the maximum payload length for the UDP datagram.<BR /><BR />Any ideas how to deal with it?<STRONG><BR /></STRONG></P><P><BR /><BR /><BR /></P><P> </P> Wed, 23 Nov 2022 21:29:02 GMT danielbb 2022-11-23T21:29:02Z UDP and the 1472 bytes limit https://community.splunk.com/t5/Getting-Data-In/UDP-and-the-1472-bytes-limit/m-p/621906#M107073 <P>We are receiving syslog data via UDP and we noticed that some data is missing.</P><P>When running - </P><LI-CODE lang="markup">tcpdump -i eth0 port <udp port></LI-CODE><P>I see lines such as - </P><LI-CODE lang="markup">UDP, bad length 5158 > 1472</LI-CODE><P><BR />And the data is not being ingested. <BR /><BR /><A title="tcpdump output with bad length indicator present" href="https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnetworkengineering.stackexchange.com%2Fquestions%2F74563%2Ftcpdump-output-with-bad-length-indicator-present&data=05%7C01%7CDan.Drillich%40ey.com%7Cdd747e3eb5df4e69f41f08daccba043e%7C5b973f9977df4bebb27daa0c70b8482c%7C0%7C0%7C638047396551230716%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=rM9Xbj7iD2jaOFqjWl3ZyzwUr9rJB0i5v0A7nRS9suE%3D&reserved=0" target="_self">https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnetworkengineering.stackexchange.com%2Fquestions%2F74563%2Ftcpdump-output-with-bad-length-indicator-present&data=05%7C01%7CDan.Drillich%40ey.com%7Cdd747e3eb5df4e69f41f08daccba043e%7C5b973f9977df4bebb27daa0c70b8482c%7C0%7C0%7C638047396551230716%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=rM9Xbj7iD2jaOFqjWl3ZyzwUr9rJB0i5v0A7nRS9suE%3D&reserved=0</A>   says - <BR /><BR /></P><P>The 1472 is the maximum payload length for the UDP datagram.<BR /><BR />Any ideas how to deal with it?<STRONG><BR /></STRONG></P><P><BR /><BR /><BR /></P><P> </P> Wed, 23 Nov 2022 21:29:02 GMT https://community.splunk.com/t5/Getting-Data-In/UDP-and-the-1472-bytes-limit/m-p/621906#M107073 danielbb 2022-11-23T21:29:02Z