# Rewriting the IP Header before Sending

**URL:** <https://discuss.elastic.co/t/rewriting-the-ip-header-before-sending/202852>\
**Category:** Logstash\
**Created:** [October 9, 2019, 2:39pm UTC](https://discuss.elastic.co/t/rewriting-the-ip-header-before-sending/202852 "2019-10-09T14:39:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bnason](https://avatars.discourse-cdn.com/v4/letter/b/e68b1a/32.png) [@bnason](https://discuss.elastic.co/u/bnason)\
**Post date:** [October 9, 2019, 2:39pm UTC](https://discuss.elastic.co/t/rewriting-the-ip-header-before-sending/202852/1 "2019-10-09T14:39:37Z")

</div>

I have a situation where I want to send syslog data (i.e. from a firewall) to two different logging environments (Elasticsearch and QRadar). If I send the original syslog data (from the firewall) to Logstash, can it rewrite the IP header information so that when it is received by Elasticsearch and QRadar that the message appears to come directly from the firewall? Basically I want QRadar not to realize that there’s something in the middle relaying the syslog data.

Thanks.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 9, 2019, 3:12pm UTC](https://discuss.elastic.co/t/rewriting-the-ip-header-before-sending/202852/2 "2019-10-09T15:12:20Z")

</div>

If you are asking whether logstash can spoof the TCP header on the outbound traffic then no, a user level process cannot do that.

---

<div class="post-metadata">

**Author:** ![bnason](https://avatars.discourse-cdn.com/v4/letter/b/e68b1a/32.png) [@bnason](https://discuss.elastic.co/u/bnason)\
**Post date:** [October 9, 2019, 3:37pm UTC](https://discuss.elastic.co/t/rewriting-the-ip-header-before-sending/202852/3 "2019-10-09T15:37:42Z")

</div>

In this case, yes but it would be UDP traffic. I’ve worked in the past with Nitro and it had a “data archival” function that would behave this way. I don’t know what it did in the background but all you had to do is supply the IP address as to where you wanted the data to sent too.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2019, 3:38pm UTC](https://discuss.elastic.co/t/rewriting-the-ip-header-before-sending/202852/4 "2019-11-06T15:38:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.