Getting Data In

New and started to input data

dxw350
Path Finder

So this is the first time I was trying to input the TCP data port to my monitoring. I am behind a NAT as it is with a FioS router in a home network environment. I wanted to monitor port 80 for web but that is not being allowed (I presume it has to do with the NAT). How do I monitor my computer as a test for traffic going/coming from the web on the Splunk monitoring tool? What settings/port numbers do I need as the input data?

Tags (1)
0 Karma

lguinn2
Legend

Splunk does not care what port you want to monitor - it can be anything. However, Splunk may be restricted because you are running Splunk from a non-privileged account (as you should).

On Linux for example, ports under 1024 are considered privileged; a non- root user cannot read these ports. This may be why you can't monitor port 80. There are ways to get around this.

I am also concerned when you say "monitor port 80 for traffic." Splunk's network inputs (TCP and UDP) read data from the port and index it; is this what you mean by "monitoring"? I feel like this is not what you want. You might also want to look at the free Splunk App for Stream

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...