[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
re: bin/44671: syslogd sends udp dgrams from port 65534
> Your expectation isn't correct. RFC5426 "Transmission of Syslog
> Messages over UDP" says:
> 3.3. Source and Target Ports
> Syslog receivers MUST support accepting syslog datagrams on the well-
> known UDP port 514, but MAY be configurable to listen on a different
> port. Syslog senders MUST support sending syslog message datagrams
> to the UDP port 514, but MAY be configurable to send messages to a
> different port. Syslog senders MAY use any source UDP port for
> transmitting messages.
> And old RFC3164 also says:
> 2. Transport Layer Protocol
> syslog uses the user datagram protocol (UDP)  as its underlying
> transport layer mechanism. The UDP port that has been assigned to
> syslog is 514. It is RECOMMENDED that the source port also be 514 to
> indicate that the message is from the syslog process of the sender,
> but there have been cases seen where valid syslog messages have come
> from a sender with a source port other than 514. If the sender uses
> a source port other than 514 then it is RECOMMENDED and has been
> considered to be good form that subsequent messages are from a single
> consistent port.
> Both suggests using sender's port to UDP/514 but not mandated. So,
> you would need to change this PR to be:
> - withdrawed.
> - changed to request adding a option to bind source port to UDP/514.
even given the above RFC info, is there any reason not to make
this the default or only option for our syslogd?
ie, what is the benefit for it not sending from port 514? (i'd
also be ok with an option to sent from whatever port.)
Main Index |
Thread Index |