<div>Ok,</div>
<div> </div>
<div>I copied the the Solaris 8 libnet-config file to the /tmp/foo folder on Solaris 9. I then ran:</div><font size="2">
<p>LD_LIBRARY_PATH=/tmp/foo:$LD_LIBRARY_PATH truss /usr/local/sbin/syslog-ng -f /usr/local/etc/syslog-ng.conf -F &</p>
<div></div></font>I get the same result... Whenever I apply the spoof_source(yes) to the config I do not get any messages forwarded to the destination. If I remove the spoof_source(yes) messages flow but with the source IP address from the syslog-ng server...
<div> </div>
<div>The truss output is quite huge! Is there any piece of the truss output that would help me to troubleshoot this? Is libnet-config the only thing I need or do I need something in addition to libnet-config?</div>
<div> </div>
<div>Thanks for all of your help!</div>
<div><br><br> </div>
<div><span class="gmail_quote">On 10/13/05, <b class="gmail_sendername">Balazs Scheidler</b> <<a href="mailto:bazsi@balabit.hu">bazsi@balabit.hu</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">On Tue, 2005-10-11 at 22:50 -0400, Chance Ellis wrote:<br>> Nate,<br>><br>> Thanks for replying. I did try that but I get the same results... UDP
<br>> destinations work until I add the spoof_source to the destination.<br>><br>> How does the spoof_source work? Does it call some external library<br>> that I have the wrong version of on the Solaris9 boxes? What about
<br>> lex? I also ran debug on the syslog-ng runtime and it just spews a<br>> bunch of senseless info. Might it be helpful if I post that?<br><br>it uses libnet to generate output packets. you might try to truss<br>
syslog-ng as it tries to send a spoofed source packet and see what it<br>does.<br><br>--<br>Bazsi<br><br>_______________________________________________<br>syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu">
syslog-ng@lists.balabit.hu</a><br><a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Frequently asked questions at <a href="http://www.campin.net/syslog-ng/faq.html">
http://www.campin.net/syslog-ng/faq.html</a><br><br></blockquote></div><br>