Getting Data In

What ports does a forwarder bind to for sending data?

CarlS
Explorer

I'm trying to determine the port range that a forwarder uses as it's source port. Assuming I'm reading $SPLUNK_HOME/var/log/splunk/metrics.log correctly, I'm seeing data sourced from ports in the 30,000 and 50,000 range.

Is this something I can specify when configuring a forwarder?

Tags (1)
0 Karma

Simeon
Splunk Employee
Splunk Employee

I do not believe you can configure the port setting for the port range that a forwarder uses as it's source. If I recall correctly, this is randomly determined by the OS.

dwaddle
SplunkTrust
SplunkTrust

'randomly' is a little unfair. The OS will choose an ephemeral port number and use that. How the OS determines the ephemeral port is OS dependent and also is related to how many ephemeral ports have been used so far. On Linux the ephemeral port range is controlled by the sysctl net.ipv4.ip_local_port_range, and on Windows it's a registry setting.

0 Karma