- Syslog is a protocol that's used
by lots of different network devices
that can output all the log messages to a server.
So it can output all that information
right to your workstation.
All right. We're logged in,
and we'll go to the LOGS option here,
and we'll see the recent log entries.
You can see at the top here:
Allowed configuration authentication by .130.
Well, 130 is the workstation that I'm working at here.
The one that's running this browser
to my local machine.
I just logged in.
I just got authenticated.
And if you look down the list here
you'll see all kinds of good information.
For example, blocked incoming UDP packet,
blocked incoming UDP packet,
blocked incoming TCP connection request.
It happens all the time.
I don't really care what you're running.
You're most likely gonna get hit by all kinds
of people that are trying to access your network
or robots that are just scanning your network.
For example, somebody from 177.85.176.165
was using port 53 to try to connect to the router.
Well, it got blocked because the firewall's doing its job.
And yeah, you may have guessed.
This is, for this particular test network,
this is my static IP out to the internet,
which I will modify
after all these videos have been recorded, of course.
But the key is, it's blocking it.
And the firewall has logged that this has happened.
So if you get hit by somebody a lot at the same IP address
you could blacklist them or report them,
or do whatever you wanna do about it.
The key here though, is that it might be
a bit of a hassle
to use your browser to connect to the router
and to access the log files in this manner.
So, especially if you have a lot of devices.
So the great thing about Syslog is
it can output all these log files
to your Syslog Server software,
which runs right at your workstation.
And from that Syslog server
you can access lots of different devices
and lots of people can access your Syslog server as well.
So makes it a lot easier.
And plus, it shows all the information
in a real nice view,
and you can do a lot of searching and filtering,
and it's a very good program to use.
So what I wanna do is
I wanna set up Syslog to export this log file.
So we'll do that from the TOOLS section.
Go to Syslog.
And we'll do enable logging to a Syslog server.
And I've already set that server up.
I've already installed the software, and it's .130.
That's the local machine that I'm working at here.
We'll save the settings.
And that'll start sending out the information
to that Syslog server.
So we're done with the router.
We don't have to do anything.
We don't have to log into that router
to see the logs anymore
'cause they're gonna automatically populate
in the Syslog software, which I'm gonna bring up now.
Now I've already downloaded this software.
I'm using Syslog Watcher, which I like.
It's free program for now.
I downloaded it, installed it
and configured it to pull information from the D-Link router
10.254.254.1.
Very easy to do.
Once you do that, you can choose how the software will work.
Now, the way I set it up
is as a local Syslog server.
So it's storing all the Syslog information
from this D-Link router,
but you could also have this information stored
on another computer, on a remote computer
and possibly, you know
maybe that's your archival computer.
Maybe it's a better type of computer
that lots of admins can connect to.
You might not want the other admins connecting
to your system.
Or perhaps the IT Director has it running
on a special computer and all the other admins want
to connect to that remote computer.
And so you get a lot of options here.
But I'm just running it locally.
So I'm gonna choose manage local Syslog server.
We'll bring that guy up, and we've already configured
like I said, we've already configured the router.
It's 10.254.254.1.
But you want to check a couple things
within the configuration when you first set it up
and within your settings.
Before I show that, what I wanna do is
I wanna start the server
and start it populating information from the router
'cause that's gonna take some time
for actual logs to appear as they happen.
So we'll start the server now.
And it says down here service started.
So that's good.
And that's gonna take a little bit to populate.
So for now we'll go to the settings
and we'll take a look at the network interfaces.
By default, when you use a Syslog server,
the Syslog Server software now.
This is what's running on your local workstation here.
It's gonna receive the syslogs,
the syslog messages from your router or your firewall
or whatever device on port 514.
And you can see some messages are coming in now.
But default port 514,
and it uses a UDP transport mechanism,
which is connection-less,
which is fine for my purposes.
But in a very, in a high security situation
connection-less might not be any good
because you might actually lose some packets
in those non-guaranteed sessions.
So you might want to use TCP.
You might wanna have guaranteed connectivity.
And to do that, this program uses port 1468.
That might vary from one program to the next.
Also some of the proprietary programs use their own port.
They might not use port 514 by default.
So that's gonna depend on the program.
So always check that in the settings.
But the default syslog port is 514.
Connection-less UDP transport mechanism.
So you always wanna check your settings.
Make sure it's working properly and configured properly.
We know this is configured properly.
It's grabbing information from .1
and it's gonna keep on grabbing the information
as the logs come in,
which is, basically, is broken down into two things:
who logged into the router and what they do.
And who's trying to connect to the router
from the outside, from the internet.
For example, the first one that came in here
is a blocked request and it shows you here
blocked incoming TCP connection request
from blah, blah, blah.
And the information also shows up on the bottom here,
and you can see exactly what happened.
Blocked incoming TCP connection.
Requests from 222.185.198.158 on port 58106
to my address, 64.121.172.56 on port 23.
Well, they're basically trying to telnet into the system.
You know, they're using port 23.
That's gonna be blocked by this firewall.
That's a basic thing that, you know
most firewalls are gonna block.
So it did its job, but it's good to know what happened
and when, and who was trying to do it.
You want to be able to read these types of logs.
You wanna understand exactly what's happening
with these types of logs.
Definitely make sure that you can run a Syslog server,
pull information from your router, your Soho device,
your firewall, multiple devices if you want.
Because you can have, you know,
multiple sources if you want.
And make sure that you can decipher these messages.
Understand what these messages are, what they mean.
It's important to understand, you know
the source IP address, the source port and your IP address
and the port that they were trying to connect to
and understand what these possible attacks could be.
For example, trying to connect through telnet
or trying to use a DNS server to connect to you.
Or possibly trying to connect
through some type of Android port or something like that.
Just trying to find an opening on your network.
One vulnerability is all it takes.
So, and it's amazing because you know
if you look at any basic firewall or, you know, Soho router
that's out there, it's gonna get hit every minute,
two minutes, every five minutes,
by some type of device out on the internet.
You know, constantly just pounding away at all the computers
it possibly can.
So it's amazing to look at,
but it's something that you want to keep in mind here.
And then of course you can import
and export this information.
You can filter this information the way you want
to find what you want
'cause there's gonna be a lot of logs as time goes on.
And again, like I said, it's really easy.
It's very manageable.
It's very easy to work with and it's a lot easier
than logging into all your different routers
and firewalls and connecting into the firmware
with your browser and checking the log files individually.
You could check 'em all from this one Syslog server screen.