Forwarding TCPDump from router to splunk machine?

[DRWhite]

Hi folks,

Trying to get receive data in Splunk to work.

It is so confusing as it has no way to set things up properly that I can find for receiving TCPDUMP stream from another machine?

I want to get things set up so that I can just have the stream sent to Splunk on a specific port and it will allow the connection then the stream will be processed.

Does anyone know how this can be achieved please?

I've been trying to get it working and I'm not getting anywhere.
I need something that will process all the connections, collate and categorise, as well as check the data that is sent so I can track full connections and data there in. 

Or is Splunk just not able to do it?

[PickleRick]

Wait a second.

It seems you're trying to bend over backwards about this. As I understand, with Splunk's help you want to analyze network traffic. This can be done but.

1. Apart from the basic Splunk installation you also need Splunk Stream which might require additional components, depending on your architecture.

2. You need a way to capture either raw traffic or SNMP with appropriate component. If you have a Netflow/IPFIX/whatever enabled router, you can do it there. If you want to capture raw traffic and analyze it (read the Splunk Stream documentation about different architectures and stream capturing options) you need to pass your traffic to your capture component. You could use an external network tap, you might try to mirror your traffic on Linux box but all those options would deal with raw network traffic, not tcpdump output.

Dumping tcp data to a pcap file and replaying it later (with aptly named tool - tcpreplay) is possible but it's a solution meant more like a forensic tool than a real-time monitoring scenario.

If it's a one-off task, you can just use tcpdump to print out relevant info from your pcap file and ingest that output as text data into Splunk.