splunk tcp-raw on bound port

[gdavid]

i am curious if its possible to have splunk collect raw tcp data from a bound port?

ex: i have a web server running on port 80. can i have splunk also listen on port 80 and collect the raw tcp data? maybe eventually parse the data where generic web server logs wouldn't be enough.

is this possible? is there another way to do this? without mirroring the port on the network side?
doesn't have to be a web server or port 80, i use this example because its an easy test for me on my pc.

thanks

Gd.

[kristian_kolb]

Splunk will not be able to bind to an already occupied port.

Perhaps you could get wireshark/tcpdump or a similar tool to capture traffic in and get Splunk to eat it. Perhaps you could get tcpdump to work as a long-running scripted input.. don't ask me to elaborate on that though, this is not something I've tried to do. 🙂

---

UPDATE:

This link might be of assistance:

http://splunk-base.splunk.com/answers/64113/scripted-input-stream-mode
http://docs.splunk.com/Documentation/Splunk/5.0.2/AdvancedDev/ScriptedInputsIntro

/k