I suspect you are seeing monitoring traffic. I set up the following test:
Created a syslog-ng instance listening on two ports:
source s_net {
udp(ip(10.0.0.194) port(514));
udp(ip(10.0.0.180) port(514));
};
Created a virtual and pool pointing to it:
ltm virtual udp-test-vitual {
destination 10.0.0.181:514
ip-protocol udp
mask 255.255.255.255
pool udp-test
profiles {
udp { }
}
source 0.0.0.0/0
vs-index 11
}
ltm pool udp-test {
members {
10.0.0.180:514 {
address 10.0.0.180
priority-group 100
session monitor-enabled
state up
}
10.0.0.194:514 {
address 10.0.0.194
session monitor-enabled
state up
}
}
monitor udp
}
I set up some traffic pointing to it:
while [ 1 ]; do logger -n 10.0.0.181 -P 514 "testing"; sleep 1; done
I then disabled the .180 listener and saw:
15:41:26.391592 IP 10.0.0.20.57185 > 10.0.0.194.514: [|syslog]
15:41:26.989738 IP 10.0.0.194.51250 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:27.993237 IP 10.0.0.194.35184 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:28.995634 IP 10.0.0.194.56747 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:29.997998 IP 10.0.0.194.58083 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:30.398929 IP 10.0.0.20.52386 > 10.0.0.180.514: [|syslog]
15:41:31.002259 IP 10.0.0.194.51332 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:31.400153 IP 10.0.0.20.57185 > 10.0.0.194.514: [|syslog]
15:41:32.007825 IP 10.0.0.194.43167 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:33.010977 IP 10.0.0.194.50478 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:34.013450 IP 10.0.0.194.55872 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:35.015700 IP 10.0.0.194.47666 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:35.407133 IP 10.0.0.20.52386 > 10.0.0.180.514: [|syslog]
15:41:36.020327 IP 10.0.0.194.39738 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:36.407760 IP 10.0.0.20.57185 > 10.0.0.194.514: [|syslog]
15:41:37.023422 IP 10.0.0.194.41399 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:38.025852 IP 10.0.0.194.54688 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:39.030245 IP 10.0.0.194.44862 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:40.035572 IP 10.0.0.194.47855 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:40.412448 IP 10.0.0.20.52386 > 10.0.0.180.514: [|syslog]
15:41:41.038749 IP 10.0.0.194.33010 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:41.312193 IP 10.0.0.20.57185 > 10.0.0.194.514: [|syslog]
15:41:42.040993 IP 10.0.0.194.36688 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:43.045679 IP 10.0.0.194.40301 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:44.050950 IP 10.0.0.194.55865 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:45.054075 IP 10.0.0.194.40416 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:45.320777 IP 10.0.0.20.52386 > 10.0.0.180.514: [|syslog]
----- Disabled listener here --------------------------------------------------------
15:41:46.056506 IP 10.0.0.194.37147 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:46.321038 IP 10.0.0.20.57185 > 10.0.0.194.514: [|syslog]
15:41:47.061121 IP 10.0.0.194.42987 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:48.066190 IP 10.0.0.194.49487 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:49.069365 IP 10.0.0.194.55249 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:50.071796 IP 10.0.0.194.45676 > 10.0.0.180.514: SYSLOG kernel.notice, length: 34
15:41:50.326123 IP 10.0.0.20.52386 > 10.0.0.180.514: [|syslog]
15:41:51.076485 IP 10.0.0.194.43712 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:51.326700 IP 10.0.0.20.57185 > 10.0.0.194.514: [|syslog]
15:41:52.079590 IP 10.0.0.194.44853 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:53.082110 IP 10.0.0.194.53688 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:54.084631 IP 10.0.0.194.53723 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:55.088803 IP 10.0.0.194.52233 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:55.331950 IP 10.0.0.20.55542 > 10.0.0.180.514: [|syslog]
15:41:56.094137 IP 10.0.0.194.43624 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
15:41:56.333928 IP 10.0.0.20.57185 > 10.0.0.194.514: [|syslog]
15:41:57.097979 IP 10.0.0.194.46896 > 10.0.0.194.514: SYSLOG kernel.notice, length: 34
Monitor traffic continued. Real traffic stopped.