You are a Network Security Officer. You have two machines. The first machine (192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perfrom a syn sca

Filtering on tcp.srcport==514 and ip.src==192.168.0.99 looks for traffic originating FROM port 514 on the Snort machine, but Snort sends to port 514, it does not source from it.

In addition to using the wrong filter direction (srcport/src instead of dstport/dst), the IP address 192.168.150 is malformed and missing an octet.

Using ip.dst==192.168.0.99 filters for traffic destined back to the Snort machine itself, which is the reverse of what needs to be observed.

Syslog messages are sent TO port 514 on the receiving syslog server, so the correct filter targets the destination port (tcp.dstport==514) and the destination IP of the Kiwi Syslog machine (ip.dst==192.168.0.150). This filter, applied on the Snort machine, will display all packets that Snort is attempting to send to the Kiwi Syslog server, confirming whether the alerts are being transmitted at all.