Getting Data In

How do I test connectivity over a specific port in Windows?

jpondrom_splunk
Splunk Employee
Splunk Employee

My forwarder is unable to establish a connection over port 9997 to my indexer.

I am running Windows, and I do not have telnet installed.

I have access to powershell. Is there a connectivity test I can run in powershell to check to ensure traffic can be passed over TCP to a specific port? It would be 9997 in this case.

I see the Tcpout processor has paused the flow of data as an error in the splunkd.log on the forwarder.

1 Solution

jpondrom_splunk
Splunk Employee
Splunk Employee

You can run the PowerShell equivalent command of telnet (Test-NetConnection) to test network connectivity over a certain port in windows.
The command is below.
Test-NetConnection -Port 9997 -ComputerName
Test-NetConnection -Port 9997 -ComputerName jpondromidx

Test-NetConnection - 10.1xx.xx.xxx:9997
Attempting TCP connect
Waiting for response

A sucess looks like the following.

PS C:\Users\jpondromfwd> Test-NetConnection -Port 9997 -ComputerName jpondromidx

ComputerName : jpondromidx
RemoteAddress : 10.xxx.xx.xxx
RemotePort : 9997
InterfaceAlias : Wi-Fi
SourceAddress : 10.xx.xxx.xxx
TcpTestSucceeded : True

A failed test looks like the below.

PS C:\Users\jpondrom> Test-NetConnection -Port 9997 -ComputerName jpondromidx2
WARNING: TCP connect to (10.xxx.xx.xxx : 9997) failed
ComputerName : jpondromidx2
RemoteAddress : 10.xxx.xx.xxx
RemotePort : 9997
InterfaceAlias : Wi-Fi
SourceAddress : 10.xx.xxx.xxx
PingSucceeded : True
PingReplyDetails (RTT) : 46 ms
TcpTestSucceeded : False

View solution in original post

jpondrom_splunk
Splunk Employee
Splunk Employee

You can run the PowerShell equivalent command of telnet (Test-NetConnection) to test network connectivity over a certain port in windows.
The command is below.
Test-NetConnection -Port 9997 -ComputerName
Test-NetConnection -Port 9997 -ComputerName jpondromidx

Test-NetConnection - 10.1xx.xx.xxx:9997
Attempting TCP connect
Waiting for response

A sucess looks like the following.

PS C:\Users\jpondromfwd> Test-NetConnection -Port 9997 -ComputerName jpondromidx

ComputerName : jpondromidx
RemoteAddress : 10.xxx.xx.xxx
RemotePort : 9997
InterfaceAlias : Wi-Fi
SourceAddress : 10.xx.xxx.xxx
TcpTestSucceeded : True

A failed test looks like the below.

PS C:\Users\jpondrom> Test-NetConnection -Port 9997 -ComputerName jpondromidx2
WARNING: TCP connect to (10.xxx.xx.xxx : 9997) failed
ComputerName : jpondromidx2
RemoteAddress : 10.xxx.xx.xxx
RemotePort : 9997
InterfaceAlias : Wi-Fi
SourceAddress : 10.xx.xxx.xxx
PingSucceeded : True
PingReplyDetails (RTT) : 46 ms
TcpTestSucceeded : False

xpac
SplunkTrust
SplunkTrust

As a former Networking guy, I hate that PS by default does not show me the actual failure reason (refused/timeout/etc), but only says it fails. Adding -Debug, I've to press Enter 4 times before the call finishes.
If anybody knows a workaround for that mess, please let me know!

0 Karma

jhornsby_splunk
Splunk Employee
Splunk Employee

An alternative is:
New-Object System.Net.Sockets.TcpClient ,

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Get Agentic with Splunk Lantern: Connect to Cisco Cloud Control, Transform ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

July Community Events: Master ITSI 5.0 & Automate Splunk

Struggling with alert fatigue or feeling like you're spending more time on infrastructure maintenance than ...

New Release of Federated Search: Bringing Splunk Analytics to More of Your Data

Organizations today are generating more data than ever and storing it across cloud object stores, data lakes, ...