Getting Data In

How do I test connectivity over a specific port in Windows?

Splunk Employee
Splunk Employee

My forwarder is unable to establish a connection over port 9997 to my indexer.

I am running Windows, and I do not have telnet installed.

I have access to powershell. Is there a connectivity test I can run in powershell to check to ensure traffic can be passed over TCP to a specific port? It would be 9997 in this case.

I see the Tcpout processor has paused the flow of data as an error in the splunkd.log on the forwarder.

1 Solution

Splunk Employee
Splunk Employee

You can run the PowerShell equivalent command of telnet (Test-NetConnection) to test network connectivity over a certain port in windows.
The command is below.
Test-NetConnection -Port 9997 -ComputerName
Test-NetConnection -Port 9997 -ComputerName jpondromidx

Test-NetConnection - 10.1xx.xx.xxx:9997
Attempting TCP connect
Waiting for response

A sucess looks like the following.

PS C:\Users\jpondromfwd> Test-NetConnection -Port 9997 -ComputerName jpondromidx

ComputerName : jpondromidx
RemoteAddress : 10.xxx.xx.xxx
RemotePort : 9997
InterfaceAlias : Wi-Fi
SourceAddress : 10.xx.xxx.xxx
TcpTestSucceeded : True

A failed test looks like the below.

PS C:\Users\jpondrom> Test-NetConnection -Port 9997 -ComputerName jpondromidx2
WARNING: TCP connect to (10.xxx.xx.xxx : 9997) failed
ComputerName : jpondromidx2
RemoteAddress : 10.xxx.xx.xxx
RemotePort : 9997
InterfaceAlias : Wi-Fi
SourceAddress : 10.xx.xxx.xxx
PingSucceeded : True
PingReplyDetails (RTT) : 46 ms
TcpTestSucceeded : False

View solution in original post

Splunk Employee
Splunk Employee

You can run the PowerShell equivalent command of telnet (Test-NetConnection) to test network connectivity over a certain port in windows.
The command is below.
Test-NetConnection -Port 9997 -ComputerName
Test-NetConnection -Port 9997 -ComputerName jpondromidx

Test-NetConnection - 10.1xx.xx.xxx:9997
Attempting TCP connect
Waiting for response

A sucess looks like the following.

PS C:\Users\jpondromfwd> Test-NetConnection -Port 9997 -ComputerName jpondromidx

ComputerName : jpondromidx
RemoteAddress : 10.xxx.xx.xxx
RemotePort : 9997
InterfaceAlias : Wi-Fi
SourceAddress : 10.xx.xxx.xxx
TcpTestSucceeded : True

A failed test looks like the below.

PS C:\Users\jpondrom> Test-NetConnection -Port 9997 -ComputerName jpondromidx2
WARNING: TCP connect to (10.xxx.xx.xxx : 9997) failed
ComputerName : jpondromidx2
RemoteAddress : 10.xxx.xx.xxx
RemotePort : 9997
InterfaceAlias : Wi-Fi
SourceAddress : 10.xx.xxx.xxx
PingSucceeded : True
PingReplyDetails (RTT) : 46 ms
TcpTestSucceeded : False

View solution in original post

SplunkTrust
SplunkTrust

As a former Networking guy, I hate that PS by default does not show me the actual failure reason (refused/timeout/etc), but only says it fails. Adding -Debug, I've to press Enter 4 times before the call finishes.
If anybody knows a workaround for that mess, please let me know!

0 Karma

Splunk Employee
Splunk Employee

An alternative is:
New-Object System.Net.Sockets.TcpClient ,

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!