TCPDUMP

 tcpdump

if you type only tcpdump then all packet will be captured on that interface which is a mess or clutter. And also difficult for analysis. 

To prevent that you can add protocol name as suffix. 

tcpdump tcp

tcpdump icmp

tcpdump tcp port 80

tcpdump tcp port 80 -v (-v for verbosity level)

Now for example, we want to extract ip address along with user agent. In that case, we can use grep command switch like --before-context or -B 6

tcpdump tcp port 80 -v | grep -i 'user-agent' --before-context 6

Reading packet contents:

In tcpdump we can use -A switch to read captured packet contents.

tcpdump tcp port 80 -A

Validating receiving syslog packets from the source device:

tcpdump -i eth0 -v -w /dev/null src 192.168.192.50 514

the ip address from where you are collecting syslog data from. 

Avi