generalize syslog parsing for TCP