You are a Network Security Officer.

Syslog messages are typically sent over UDP or TCP port 514 to the Syslog server. In this case, Snort (192.168.0.99) should send alerts to Kiwi Syslog (192.168.0.150) using TCP/UDP port 514.

The correct Wireshark filter to check if Snort is sending the messages to the Syslog server is:

tcp.dstport==514 && ip.dst==192.168.0.150

Reference – CEH v13 Official Study Guide:

Module 8: Sniffing

Topic: Packet Sniffing and Analysis

Quote:

“Wireshark filters like tcp.dstport and ip.dst can be used to verify outbound logs and traffic from intrusion detection systems.”

Incorrect Options:

A & B: Use incorrect IP addresses or direction

C: Uses incorrect destination IP (should be the Syslog server)

===========