$ tshark -r ubuntu-syslog.pcap -n -t ad -Y 'frame.number <= 5' 1 2026-09-12 08:29:45.569384 192.168.100.1 → 192.168.100.10 Syslog 128 LOCAL7.NOTICE: 69: R1: *Sep 11 23:29:44.473: %SYS-5-CONFIG_I: Configured from console by console 2 2026-09-12 08:30:05.385447 192.168.100.1 → 192.168.100.10 Syslog 203 LOCAL7.NOTICE: 70: R1: *Sep 11 23:30:04.049: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: kazulog] [Source: 10.100.3.1] [localport: 22] at 23:30:04 UTC Fri Sep 11 2026 3 2026-09-12 08:30:07.610694 192.168.100.1 → 192.168.100.10 Syslog 162 LOCAL7.INFO: 71: R1: *Sep 11 23:30:07.482: %KAZULOG-6-TESTMSG: Message from tty1(user id: kazulog): kazulog-test-message from R1 4 2026-09-12 08:30:08.610247 192.168.100.1 → 192.168.100.10 Syslog 141 LOCAL7.INFO: 72: R1: *Sep 11 23:30:07.514: %SYS-6-LOGOUT: User kazulog has exited tty session 1(10.100.3.1) 5 2026-09-12 08:30:12.226226 192.168.100.20 → 192.168.100.10 Syslog 191 USER.NOTICE: 1 2026-09-12T08:30:12.237901+09:00 sv2 kazulog-udp - - [timeQuality tzKnown="1" isSynced="1" syncAccuracy="134839"] kazulog-test-message over UDP $ tshark -r ubuntu-syslog.pcap -n -V -O syslog -Y 'frame.number == 1' Frame 1: Packet, 128 bytes on wire (1024 bits), 128 bytes captured (1024 bits) Ethernet II, Src: 52:54:00:93:66:9a, Dst: 52:54:00:d1:0a:14 Internet Protocol Version 4, Src: 192.168.100.1, Dst: 192.168.100.10 User Datagram Protocol, Src Port: 53762, Dst Port: 514 Syslog message: LOCAL7.NOTICE: 69: R1: *Sep 11 23:29:44.473: %SYS-5-CONFIG_I: Configured from console by console .... ..00 1011 1... = Facility: LOCAL7 - reserved for local use (23) .... .... .... .101 = Level: NOTICE - normal but significant condition (5) Message: 69: R1: *Sep 11 23:29:44.473: %SYS-5-CONFIG_I: Configured from console by console [Expert Info (Note/Protocol): Message conforms to neither RFC 5424 nor RFC 3164; trailing data appended] [Message conforms to neither RFC 5424 nor RFC 3164; trailing data appended] [Severity level: Note] [Group: Protocol] $ tshark -r ubuntu-syslog.pcap -n -V -O syslog -Y 'frame.number == 5' Frame 5: Packet, 191 bytes on wire (1528 bits), 191 bytes captured (1528 bits) Ethernet II, Src: 52:54:00:df:e0:dc, Dst: 52:54:00:d1:0a:14 Internet Protocol Version 4, Src: 192.168.100.20, Dst: 192.168.100.10 User Datagram Protocol, Src Port: 44687, Dst Port: 514 Syslog message: USER.NOTICE: 1 2026-09-12T08:30:12.237901+09:00 sv2 kazulog-udp - - [timeQuality tzKnown="1" isSynced="1" syncAccuracy="134839"] kazulog-test-message over UDP .... ..00 0000 1... = Facility: USER - random user-level messages (1) .... .... .... .101 = Level: NOTICE - normal but significant condition (5) Version: 1 Timestamp: Sep 12, 2026 08:30:12.237901000 JST Hostname: sv2 App Name: kazulog-udp Process ID: - Message ID: - Structured Data (1 element) Element (timeQuality) (3 parameters) Element Name: timeQuality Parameter (tzKnown) Parameter Name: tzKnown Parameter Value: 1 Parameter (isSynced) Parameter Name: isSynced Parameter Value: 1 Parameter (syncAccuracy) Parameter Name: syncAccuracy Parameter Value: 134839 Message: kazulog-test-message over UDP $ tshark -r ubuntu-syslog.pcap -n -d tcp.port==514,syslog -Y 'tcp.stream == 0 && syslog' -T fields -e frame.number -e ip.src -e syslog.facility -e syslog.msg 9 192.168.100.20 1 kazulog-test-message over TCP\n $ tshark -r ubuntu-syslog.pcap -n -t ad -Y 'tcp.stream == 0' 6 2026-09-12 08:30:12.275358 192.168.100.20 → 192.168.100.10 TCP 74 46098 → 514 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=1586745324 TSecr=0 WS=256 7 2026-09-12 08:30:12.276303 192.168.100.10 → 192.168.100.20 TCP 74 514 → 46098 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM TSval=1354922390 TSecr=1586745324 WS=256 8 2026-09-12 08:30:12.277115 192.168.100.20 → 192.168.100.10 TCP 66 46098 → 514 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=1586745326 TSecr=1354922390 9 2026-09-12 08:30:12.277270 192.168.100.20 → 192.168.100.10 RSH 216 Client -> Server data 10 2026-09-12 08:30:12.277373 192.168.100.20 → 192.168.100.10 TCP 66 46098 → 514 [FIN, ACK] Seq=151 Ack=1 Win=64256 Len=0 TSval=1586745327 TSecr=1354922390 11 2026-09-12 08:30:12.278244 192.168.100.10 → 192.168.100.20 TCP 66 514 → 46098 [ACK] Seq=1 Ack=151 Win=65024 Len=0 TSval=1354922392 TSecr=1586745326 12 2026-09-12 08:30:12.319384 192.168.100.10 → 192.168.100.20 TCP 66 514 → 46098 [ACK] Seq=1 Ack=152 Win=65024 Len=0 TSval=1354922433 TSecr=1586745327 13 2026-09-12 08:30:12.587962 192.168.100.10 → 192.168.100.20 TCP 66 514 → 46098 [FIN, ACK] Seq=1 Ack=152 Win=65024 Len=0 TSval=1354922701 TSecr=1586745327 14 2026-09-12 08:30:12.588628 192.168.100.20 → 192.168.100.10 TCP 66 46098 → 514 [ACK] Seq=152 Ack=2 Win=64256 Len=0 TSval=1586745638 TSecr=1354922701 $ tshark -r ubuntu-syslog.pcap -n -t ad -Y 'frame.number >= 15 && frame.number <= 22' 15 2026-09-12 08:30:33.716887 192.168.100.20 → 192.168.100.10 TCP 74 36452 → 514 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=2878964534 TSecr=0 WS=256 16 2026-09-12 08:30:33.717884 192.168.100.10 → 192.168.100.20 TCP 74 514 → 36452 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM TSval=2658807182 TSecr=2878964534 WS=256 17 2026-09-12 08:30:33.718545 192.168.100.20 → 192.168.100.10 TCP 66 36452 → 514 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=2878964536 TSecr=2658807182 18 2026-09-12 08:30:33.718651 192.168.100.20 → 192.168.100.10 RSH 1117 Client -> Server data 19 2026-09-12 08:30:33.719381 192.168.100.10 → 192.168.100.20 TCP 66 514 → 36452 [ACK] Seq=1 Ack=1052 Win=68096 Len=0 TSval=2658807184 TSecr=2878964536 20 2026-09-12 08:30:33.719773 192.168.100.20 → 192.168.100.10 RSH 346 Client -> Server data 21 2026-09-12 08:30:33.720326 192.168.100.10 → 192.168.100.20 TCP 66 514 → 36452 [ACK] Seq=1 Ack=1332 Win=70400 Len=0 TSval=2658807185 TSecr=2878964537 22 2026-09-12 08:30:33.763520 192.168.100.20 → 192.168.100.10 RSH 145 Client -> Server data $ tshark -r ubuntu-syslog.pcap -n -Y 'tcp.stream == 6' -T fields -e frame.number | wc -l 41 $ tshark -r ubuntu-syslog.pcap -n -t ad -Y '(frame.number >= 708 && frame.number <= 713) || frame.number == 748' 708 2026-09-12 08:33:08.064218 192.168.100.20 → 192.168.100.10 TCP 74 40616 → 514 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=4097793459 TSecr=0 WS=256 709 2026-09-12 08:33:08.064787 192.168.100.10 → 192.168.100.20 TCP 74 514 → 40616 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM TSval=2615597037 TSecr=4097793459 WS=256 710 2026-09-12 08:33:08.065530 192.168.100.20 → 192.168.100.10 TCP 66 40616 → 514 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=4097793461 TSecr=2615597037 711 2026-09-12 08:33:08.066662 192.168.100.20 → 192.168.100.10 RSH 236 Client -> Server data 712 2026-09-12 08:33:08.067214 192.168.100.10 → 192.168.100.20 TCP 66 514 → 40616 [ACK] Seq=1 Ack=171 Win=65024 Len=0 TSval=2615597039 TSecr=4097793462 713 2026-09-12 08:33:08.069621 192.168.100.20 → 192.168.100.10 RSH 1094 Client -> Server data 748 2026-09-12 08:33:08.370433 192.168.100.10 → 192.168.100.20 TCP 66 514 → 40616 [RST, ACK] Seq=1 Ack=3638 Win=70912 Len=0 TSval=2615597342 TSecr=4097793747