Error encountered for connection from src=10.100.100.137:48221. Local side shutting down

[itmonitoring]

I'm seeing this error in a heavy forwarder, but I couldn't find any information as to what it could mean.

07-26-2013 14:53:59.324 -0600 ERROR TcpInputProc - Error encountered for connection from src=10.100.100.137:48221. Local side shutting down

The configuration I have is pretty simple:

Host -> HEAVY FORWARDER -> INDEXER

The error above shows up in splunkd.log in the Heavy Forwarder and no data makes it to the indexer.

What does it mean?

[sjohnson_splunk]

First, are you expecting input from that host? If no, then I suspect that it might be something like a vulnerability scanner probing the HF.

If yes and the HF is linux, how many open files are available? (look in the splunkd.log for ulimit open files). Could be you ran out of file handles if there are a lot of forwarders connecting to the HF.

[rsennett_splunk]

Are there other messages earlier in the log?
You might want to take a look at this:
http://splunk-base.splunk.com/answers/43285/error-tcpinputproc-error-encountered-for-connection-from...

[sf_user_199]

I've seen this too occasionally with a very similar setup.