Relay, route, and fan out your network telemetry
Modern NOC and SOC teams need to get syslog messages and SNMP traps from hundreds of devices to multiple destinations — a SIEM, a long-term archive, an NMS collector — without losing the original source identity and without a single point of failure.
That’s what these tools do:
Echo Base — Syslog Relay and Exploder
Echo Base is a syslog relay and exploder with IP spoofing, rule-based routing, fan-out, and health-checked destination pools. Listens on UDP 514 and 5514.
Echo Station — SNMP Trap Relay and Trap Exploder
Echo Station is an SNMP trap relay and trap exploder with IP spoofing, rule-based routing, fan-out, and health-checked destination pools. Listens on UDP 162 and 1162.
Endor Ops — Free SNMP and Syslog Load Testing Tool
Endor Ops is a free, open-source distributed load-testing tool for SNMP traps and syslog messages. Benchmark your relay or monitoring infrastructure before you deploy.
Why teams choose these relays
IP spoofing that preserves source identity. Downstream systems see the original device’s IP address, not the relay’s — so your SIEM, NMS, or archive doesn’t need to know a relay is even in the path.
Rule-based routing and fan-out. Route by source IP, facility, severity, trap OID, and more. Duplicate a single message to multiple destination pools simultaneously.
Health-checked destination pools. ICMP health checking with configurable thresholds means traffic automatically avoids dead destinations.
Built to be benchmarked. Endor Ops is a free distributed load tester for SNMP and syslog traffic — see exactly how your relay performs before you commit to a deployment.
Deployment
Both Echo Base and Echo Station run as a single Go binary or Docker container — deployable on bare metal, in a Proxmox LXC, or in Docker. No message brokers, no databases beyond local SQLite for auth, no dependencies to manage.