What is a syslog exploder?
A syslog exploder (also called a syslog relay) receives syslog messages from network devices and "explodes" — fans out — a copy of each message to multiple downstream destinations, such as a SIEM and a long-term archive at the same time. Echo Base is our syslog exploder, with rule-based routing and IP spoofing built in.
What is a trap exploder?
A trap exploder (also called an SNMP trap relay) does the same job for SNMP traps instead of syslog — receiving traps from network devices and fanning them out to one or more monitoring or NMS destinations. Echo Station is our trap exploder, supporting SNMPv1, v2c, and v3 pass-through.
What does IP spoofing mean in this context, and why does it matter?
When Echo Base or Echo Station forwards a message, it can send it from the original device's IP address rather than its own, using raw sockets. This means your downstream SIEM, NMS, or archive sees the real source device — not the relay — which matters for correlation, alerting, and any tooling that keys off source IP.
What's the difference between Echo Base and Echo Station?
Echo Base relays syslog messages (UDP 514/5514). Echo Station relays SNMP traps (UDP 162/1162). They share the same underlying architecture — rule-based routing, health-checked destination pools, fan-out — so if you need both syslog and trap relaying, you'd run one of each.
How is this priced?
Per node, per year, starting from a single node. Standard support starts at $250/node/year, with Priority and Enterprise tiers available for faster or after-hours support. See the pricing page for full details.
Is there a free way to try this before buying?
Yes — Endor Ops is our free, open-source load-testing tool for SNMP and syslog traffic. Use it to benchmark your network and infrastructure at realistic volumes before deciding whether Echo Base or Echo Station fits your needs.
Does Echo Station support SNMPv3?
Echo Station forwards SNMPv3 traps as opaque pass-through, byte-for-byte, rather than dropping them. Full authPriv decoding requires a per-device credential store, which is planned for a future release — until then, v3 rule matching works on source IP and version.
How do I deploy Echo Base or Echo Station?
Both run as a single Go binary or Docker container. They deploy cleanly on bare metal, in a Proxmox LXC (with the NET_RAW capability for IP spoofing), or via Docker with
--network=host --cap-add=NET_RAW.
Is support available outside business hours?
Yes, at the Priority and Enterprise support tiers. Standard support is business-hours email; Priority adds a next-business-day SLA; Enterprise adds after-hours and on-call coverage with a dedicated contact. See pricing for details.