See why delimiter framing is not transparent
04The older method places a trailer after the message, commonly a line feed (LF). The receiver searches for that trailer. If the same byte occurs inside the message without escaping, the receiver cannot reliably distinguish message content from the end marker.
Alternative devices use NUL or CR LF trailers. If sender uses CR LF but receiver removes only LF, a CR remains at the end of the payload. The pictured mismatch is not fixed by assuming every device strips both. One- and two-byte trailers must be interpreted as configured.
Source for this drawing: RFC 6587 · Read RFC section 3.4.2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
An unescaped delimiter inside a message can create false boundaries.
- The observed grammar is SYSLOG-FRAME = SYSLOG-MSG TRAILER, with TRAILER = LF or an application-defined one- or two-octet value. Common observations include LF, NUL and CR LF; none is a universal negotiated default guaranteed across devices.
- Non-transparent framing traditionally does not escape the trailer within message content. A legacy message containing LF can be misinterpreted as several pieces by an LF-delimited receiver. Those pieces need not themselves be valid complete syslog messages.
- The delimiter parser in this guide removes exactly the selected trailer bytes and preserves all preceding bytes. It does not silently strip CR when configured for LF, nor invent a universal escaping convention.
- Selecting a different trailer only changes which byte sequence is ambiguous. Compatible endpoint configuration matters. A first byte < suggests non-transparent framing, while a leading digit suggests octet counting; these are observations, not a new capability negotiation exchange.
LF is byte 0A, CR is 0D, NUL is 00 in hexadecimal. The scanner illustrates ambiguity and configuration, not a safe universal syslog grammar. No escape rule is invented; frame-level transparency and message-level content rules remain separate.
Read the RFC section ↗