You are a Network Security Officer. You have two machines. The first machine (192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perfrom a syn…

tcp.srcport==514 is incorrect because port 514 is the destination port on the syslog server - the Snort machine sends from an ephemeral source port, not from port 514.

The IP 192.168.150 is a malformed address missing one octet, and srcport==514 applies the wrong directionality for this traffic flow.

ip.dst==192.168.0.99 targets the Snort machine as the destination, which captures traffic arriving at Snort rather than traffic being sent from it to Kiwi.

Syslog messages are sent TO the Kiwi syslog server at 192.168.0.150 on its listening port 514, so the filter tcp.dstport==514 && ip.dst==192.168.0.150 correctly isolates those packets. Running this on the Snort machine will confirm whether alert traffic is actually being transmitted toward the Kiwi server, isolating whether the issue is in Snort's output configuration or the network path.