Network Security Blog

In my last blog entry I linked to an excellent writeup on how to do log analysis on the cheap using Kiwi Syslog Daemon. One thing I wanted to know is if Kiwi could be set up to listen on an interface that doesn’t have an IP address and is just listening in promiscuous mode. So I sent the folks at Kiwi an email asking. They got back to me within an hour or so! That’s great customer service, especially from a company who’s supporting a freeware product. The full text of their reply is in the extended entry. By the way, so far, the answer to my question was ‘no’.

From the Kiwi Support Team

Martin,

Thanks for the enquiry.

Kiwi Syslog Daemon has to bind to a specific port on a NIC. You can specify the port and also the interface card on your system to bind to (if you have more than one NIC installed).

These options are found from the File | Setup | Inputs menu pages.

Kiwi Syslog Daemon currently only has the ability to bind to a single UDP port and a single TCP port to listen for syslog messages.

It also has the ability to listen for SNMP traps by binding to UDP port 162.

We may look at adding the ability to bind to multiple ports in a future release.

Please let me know if you have any further questions.

Kind regards,

Justin

Kiwi Enterprises
Quality Networking Tools at Affordable Prices http://www.kiwisyslog.com