Searchhead not able to communicate (tcp handshake with indexer on port 9997) just showing SYn packets captured

[thaghost99]

hi, i am setting up a search head/indexer setup. 

i have port 9997 listening on indexer, i configured searchhead to send to indexer (since i have the files being sent to search head). 

i can see the syn packets being sent from search head to indexer, but thats about it. i am not sure what the indexer is doing about it, its not sending any error back or anything.

capture tcp dump on indexer

capture tcp dump and logs from searchhead.

let me know what i need to do to fix this. 🙂 thank you in advanced

[PickleRick]

1. I don't understand what you mean by "I have files sent to search head". If you're trying to use your SH also as a forwarder... well, that's not a good practice. But it shouldn't be the cause of the problem here.

2. Since you're sending SYNs, the indexer is listening on the port and apparently even gets those SYNs on the wire, there are two possible explanations - either your local firewall (iptables? firewalld? that new fancy nftables?) is filtering the packets or you have badly configured routing and packets are dropped by rp_filter.

[thaghost99 · Accepted solution]

yeah its was 100% my fault. i forgot to disable the local firewall on the server. 😞

thank you though for the help.