Did you try Pcapng specification? I believe it is used by new syslog, and this is the packet format for logging both network interfaces, syslog files, and many more things together in a single format. https://wiki.wireshark.org/SampleCaptures https://wiki.wireshark.org/Development/PcapNg