Getting Data In

How do I test connectivity over a specific port in Windows?

jpondrom_splunk
Splunk Employee
Splunk Employee

My forwarder is unable to establish a connection over port 9997 to my indexer.

I am running Windows, and I do not have telnet installed.

I have access to powershell. Is there a connectivity test I can run in powershell to check to ensure traffic can be passed over TCP to a specific port? It would be 9997 in this case.

I see the Tcpout processor has paused the flow of data as an error in the splunkd.log on the forwarder.

1 Solution

jpondrom_splunk
Splunk Employee
Splunk Employee

You can run the PowerShell equivalent command of telnet (Test-NetConnection) to test network connectivity over a certain port in windows.
The command is below.
Test-NetConnection -Port 9997 -ComputerName
Test-NetConnection -Port 9997 -ComputerName jpondromidx

Test-NetConnection - 10.1xx.xx.xxx:9997
Attempting TCP connect
Waiting for response

A sucess looks like the following.

PS C:\Users\jpondromfwd> Test-NetConnection -Port 9997 -ComputerName jpondromidx

ComputerName : jpondromidx
RemoteAddress : 10.xxx.xx.xxx
RemotePort : 9997
InterfaceAlias : Wi-Fi
SourceAddress : 10.xx.xxx.xxx
TcpTestSucceeded : True

A failed test looks like the below.

PS C:\Users\jpondrom> Test-NetConnection -Port 9997 -ComputerName jpondromidx2
WARNING: TCP connect to (10.xxx.xx.xxx : 9997) failed
ComputerName : jpondromidx2
RemoteAddress : 10.xxx.xx.xxx
RemotePort : 9997
InterfaceAlias : Wi-Fi
SourceAddress : 10.xx.xxx.xxx
PingSucceeded : True
PingReplyDetails (RTT) : 46 ms
TcpTestSucceeded : False

View solution in original post

jpondrom_splunk
Splunk Employee
Splunk Employee

You can run the PowerShell equivalent command of telnet (Test-NetConnection) to test network connectivity over a certain port in windows.
The command is below.
Test-NetConnection -Port 9997 -ComputerName
Test-NetConnection -Port 9997 -ComputerName jpondromidx

Test-NetConnection - 10.1xx.xx.xxx:9997
Attempting TCP connect
Waiting for response

A sucess looks like the following.

PS C:\Users\jpondromfwd> Test-NetConnection -Port 9997 -ComputerName jpondromidx

ComputerName : jpondromidx
RemoteAddress : 10.xxx.xx.xxx
RemotePort : 9997
InterfaceAlias : Wi-Fi
SourceAddress : 10.xx.xxx.xxx
TcpTestSucceeded : True

A failed test looks like the below.

PS C:\Users\jpondrom> Test-NetConnection -Port 9997 -ComputerName jpondromidx2
WARNING: TCP connect to (10.xxx.xx.xxx : 9997) failed
ComputerName : jpondromidx2
RemoteAddress : 10.xxx.xx.xxx
RemotePort : 9997
InterfaceAlias : Wi-Fi
SourceAddress : 10.xx.xxx.xxx
PingSucceeded : True
PingReplyDetails (RTT) : 46 ms
TcpTestSucceeded : False

xpac
SplunkTrust
SplunkTrust

As a former Networking guy, I hate that PS by default does not show me the actual failure reason (refused/timeout/etc), but only says it fails. Adding -Debug, I've to press Enter 4 times before the call finishes.
If anybody knows a workaround for that mess, please let me know!

0 Karma

jhornsby_splunk
Splunk Employee
Splunk Employee

An alternative is:
New-Object System.Net.Sockets.TcpClient ,

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...