What ports does a forwarder bind to for sending data?

[CarlS]

I'm trying to determine the port range that a forwarder uses as it's source port. Assuming I'm reading $SPLUNK_HOME/var/log/splunk/metrics.log correctly, I'm seeing data sourced from ports in the 30,000 and 50,000 range.

Is this something I can specify when configuring a forwarder?

[Simeon]

I do not believe you can configure the port setting for the port range that a forwarder uses as it's source. If I recall correctly, this is randomly determined by the OS.

[dwaddle]

'randomly' is a little unfair. The OS will choose an ephemeral port number and use that. How the OS determines the ephemeral port is OS dependent and also is related to how many ephemeral ports have been used so far. On Linux the ephemeral port range is controlled by the sysctl net.ipv4.ip_local_port_range, and on Windows it's a registry setting.