Certopolis

CompTIA Network+ (V9)

Syslog, flow data and packet capture compared for Network+

Syslog carries log messages from devices to a collector, normally on UDP 514, with no acknowledgement, so dropped messages are lost. Flow data summarizes traffic by keys such as the 5-tuple with byte and packet counts, but not contents. Packet capture records the frames themselves, so it is the only one of the three that shows what was actually sent.

Syslog messages and transport

RFC 5424 defines eight severity codes: 0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Informational and 7 Debug. A lower number is more severe.

The priority value at the start of a message is the facility number multiplied by 8, plus the severity. A local use 4 message (facility 20) at Notice (severity 5) has priority 165, written <165>.

RFC 5426 maps syslog onto UDP: collectors listen on UDP port 514, and senders send to it. The mapping has no way to detect or correct lost datagrams and no acknowledgement or retransmission. A busy router on a congested link can therefore leave gaps that neither side notices. RFC 5424 requires implementations to support a TLS-based transport (RFC 5425) and recommends it.

Flow data versus packet capture

RFC 7011 (IPFIX) defines a flow as packets passing an observation point in a time interval that share common properties, called flow keys. Its example is the 5-tuple: source and destination IP address, source and destination port, and transport protocol. A flow record adds measured values such as the total bytes.

So flow data answers who talked to whom, on which ports, and how much. It does not hold the conversation. RFC 7011 treats exporting end-user payload as an exception that needs extra protection.

Example: to see why a file transfer stalls, you need the frames, which is packet capture. To find which host used most of the WAN link last night, flow records are enough.

Aggregation and normalization

NIST SP 800-92 describes a log management infrastructure in tiers. Hosts generate logs and send them to log servers. Servers that receive log data from many generators are sometimes called collectors or aggregators.

Normalization converts each log field to one representation. SP 800-92's example: one source stores time in twelve-hour format, another in twenty-four-hour format with the time zone in a separate field. Normalizing makes them comparable.

SP 800-92 also recommends NTP so that log sources' clocks agree. Without it, events from two devices cannot be put in the right order.

Where the exam catches people

  • Believing syslog over UDP resends lost messages: RFC 5426 provides no acknowledgement or retransmission, so lost messages are gone.
  • Believing severity 7 is the most serious syslog level: 0 is Emergency and 7 is Debug.
  • Believing flow records show what was sent: they hold keys and counts; reading the contents needs packet capture.
  • Believing aggregation and normalization are the same step: aggregation gathers logs in one place, normalization puts their fields in one format.

Written from CompTIA's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. A syslog collector shows gaps in a busy router's messages, and neither device detects or resends the missing ones. Which of the following transports is the router most likely using?

    Right. In the game that’s Renown for your Network Operations building.

    Not that one: A is right. In the game your Network Operations building would lose a little Renown, and this question would come back later.

    Written from www.rfc-editor.org/rfc/rfc5426.txt

  2. A router groups traffic crossing an interface by source and destination address, port and transport protocol, keeping byte and packet counts for each group. Which of the following monitoring methods produces these records?

    Right. In the game that’s Renown for your Network Operations building.

    Not that one: D is right. In the game your Network Operations building would lose a little Renown, and this question would come back later.

    Written from www.rfc-editor.org/rfc/rfc7011.txt

  3. One log source records event times in twelve-hour format and another in twenty-four-hour format with the time zone in a separate field. Which of the following processes puts them in one form?

    Right. In the game that’s Renown for your Network Operations building.

    Not that one: A is right. In the game your Network Operations building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    One of the most common uses of normalization is storing dates and times in a single format', and gives exactly this example: one generator storing 'a twelve-hour format' timestamp and another a 'twenty-four' hour time with the time zone in a different field.

    Written from nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf