Getting Data In

What ports does a forwarder bind to for sending data?

Explorer

I'm trying to determine the port range that a forwarder uses as it's source port. Assuming I'm reading $SPLUNK_HOME/var/log/splunk/metrics.log correctly, I'm seeing data sourced from ports in the 30,000 and 50,000 range.

Is this something I can specify when configuring a forwarder?

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

I do not believe you can configure the port setting for the port range that a forwarder uses as it's source. If I recall correctly, this is randomly determined by the OS.

SplunkTrust
SplunkTrust

'randomly' is a little unfair. The OS will choose an ephemeral port number and use that. How the OS determines the ephemeral port is OS dependent and also is related to how many ephemeral ports have been used so far. On Linux the ephemeral port range is controlled by the sysctl net.ipv4.ip_local_port_range, and on Windows it's a registry setting.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!