omudpspoof: UDP spoofing output module¶

Module Name:	omudpspoof
Author:	David Lang <david@lang.hm> and Rainer Gerhards <rgerhards@adiscon.com>
Available Since:	5.1.3

Purpose¶

This module is similar to the regular UDP forwarder, but permits to spoof the sender address. Also, it enables to circle through a number of source ports.

Important: This module requires root permissions. This is a hard requirement because raw socket access is necessary to fake UDP sender addresses. As such, rsyslog cannot drop privileges if this module is to be used. Ensure that you do not use $PrivDropToUser or $PrivDropToGroup. Many distro default configurations (notably Ubuntu) contain these statements. You need to remove or comment them out if you want to use omudpspoof.

Configuration Parameters¶

Note

Parameter names are case-insensitive; camelCase is recommended for readability.

Module Parameters¶

Parameter	Summary
template	Sets the default template used by omudpspoof actions without an explicitly configured template.

Action Parameters¶

Parameter	Summary
target	Sets the destination host to which omudpspoof sends messages.
port	Specifies the destination port used when sending messages.
sourceTemplate	Names the template that provides the spoofed source IP address for sent messages.
sourcePort.start	Sets the starting source port when cycling through spoofed source ports.
sourcePort.end	Sets the ending source port when cycling through spoofed source ports.
mtu	Sets the maximum packet length that omudpspoof sends.
template	Sets the default template used by omudpspoof actions without an explicitly configured template.

Caveats/Known Bugs¶

IPv6 is currently not supported. If you need this capability, please let us know via the rsyslog mailing list.
Throughput is MUCH smaller than when using omfwd module.

Examples¶

Forwarding message through multiple ports¶

Forward the message to 192.168.1.1, using original source and port between 10000 and 19999.

action(
  type="omudpspoof"
  target="192.168.1.1"
  sourcePort.start="10000"
  sourcePort.end="19999"
)

Forwarding message using another source address¶

Forward the message to 192.168.1.1, using source address 192.168.111.111 and default ports.

module(
  load="omudpspoof"
)
template(
  name="spoofaddr"
  type="string"
  string="192.168.111.111"
)
action(
  type="omudpspoof"
  target="192.168.1.1"
  sourceTemplate="spoofaddr"
)

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project