Internal communications on Splunk server(Indexer, Search Head)- Can anyone explain when this happens?

[WildHuckleberry]

Hello Splunkers!!

We got some issues with internal communications, and wondering about the cause of those internal communications and if this is normal (not an error), can anyone explain when this internal communication happens? 

Interface:lo

Internal Communications: 
(127.0.0.1:8089 => 127.0.0.1:XXXXX, 127.0.0.1:XXXXX => 127.0.0.1:8089, 127.0.0.1:25 => 127.0.0.1:XXXXX) (172.16.18.23:XXXXX => 172.16.17.23:XXXXX)

Thank you for the work that will be provided.

[richgalloway · Accepted solution]

Splunk's management port is 8089, but there should be no communications originating from that port.

Port 25 is for SMTP.  Again, sessions will not originate from that port.  Splunk should only connect to port 25 to send alerts or as a result of a sendemail command.

The comms between 172.16.18.23 and 172.16.17.23 could be anything and may have nothing to do with Splunk.