# Log message with strange source Ip address

**URL:** <https://community.graylog.org/t/log-message-with-strange-source-ip-address/23265>\
**Category:** Graylog Central (peer support)\
**Tags:** key\_value\
**Created:** [March 30, 2022, 8:17pm UTC](https://community.graylog.org/t/log-message-with-strange-source-ip-address/23265 "2022-03-30T20:17:57Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![miguel](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@miguel](https://community.graylog.org/u/miguel)\
**Post date:** [March 30, 2022, 8:17pm UTC](https://community.graylog.org/t/log-message-with-strange-source-ip-address/23265/1 "2022-03-30T20:17:57Z")

</div>

I everybody,

I recently installed graylog.  
Until now everyting is ok except for one stuff:  
Messages from old cisco switchs 3500XL series it cannot get the IP.

With tcpdump i can verify that the message arrivers correctly:

- “20:02:01.779553 IP 10.100.38.134.58986 \>…”

But in the graylog gui i get someting like:

- “source 294579:”

Can someone help me?

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [March 31, 2022, 12:23am UTC](https://community.graylog.org/t/log-message-with-strange-source-ip-address/23265/2 "2022-03-31T00:23:35Z")

</div>

Hello && welcome @miguel

I would like to help, Please provide more information and configuration about your setup.  
INPUTs used , Extractors used, Pipelines, etc… this will help us, help you.

---

<div class="post-metadata">

**Author:** ![miguel](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@miguel](https://community.graylog.org/u/miguel)\
**Post date:** [March 31, 2022, 4:27pm UTC](https://community.graylog.org/t/log-message-with-strange-source-ip-address/23265/3 "2022-03-31T16:27:14Z")

</div>

Install was made follwing the documentation.  
No INPUTs configured and no exctrators used.  
The pipelines i use is only to drop useless messages like ports up/down and PoE messages.  
I configured two streams one for syslog messages from aruba switchs and other for cisco switchs, only to separate the syslog messages by manufacturer.

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [March 31, 2022, 6:26pm UTC](https://community.graylog.org/t/log-message-with-strange-source-ip-address/23265/4 "2022-03-31T18:26:34Z")

</div>

> [@miguel](#):
>
> No INPUTs configured

Inputs are required to receive the information the Cisco switches are sending you. The Input should generally match the type of data sent (i.e. Syslog, GELF, etc) … the port number should match as well…

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [March 31, 2022, 10:16pm UTC](https://community.graylog.org/t/log-message-with-strange-source-ip-address/23265/5 "2022-03-31T22:16:13Z")

</div>

Hello,

You may want to read this documentation.

- [Sending in log data](https://docs.graylog.org/v1/docs/sending-data)

Hope that helps

---

<div class="post-metadata">

**Author:** ![miguel](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@miguel](https://community.graylog.org/u/miguel)\
**Post date:** [April 7, 2022, 8:26am UTC](https://community.graylog.org/t/log-message-with-strange-source-ip-address/23265/6 "2022-04-07T08:26:35Z")

</div>

Thank you all.  
I found the source of the problem.  
This only happens with older switches (cisco 2950, 2900XL, 3500XL, etc).  
If you enable **service sequence-numbers** the switch inserts two sequence numbers instead of just one. if you disable the command **service sequence-numbers** (no service sequence-numbers) the problem disappears.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [April 21, 2022, 8:27am UTC](https://community.graylog.org/t/log-message-with-strange-source-ip-address/23265/7 "2022-04-21T08:27:03Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.