01Splunk Indexer Receivingtcp · unofficial · risk 6/10
Splunk indexers use TCP 9997 by default to receive data from forwarders.
port 9997 as Splunk Indexer Receiving →Port 99972 services
2 entries are registered on port 9997. It is a registered port (1024–49151) — IANA records an assignee, but nothing stops other software from listening here, which is why the number carries more than one entry.
- entries
- 2
- transport
- tcp · udp
- in transit
- 0/2
- worst risk
- 6/10
services registered on this number
2 transports in use
entries encrypted on the wire
1 of 2 iana-registered
Services on this port
| port | service | risk | |||
|---|---|---|---|---|---|
| :9997 | Splunk Indexer Receiving | TCP | Security | risk | 0 |
| :9997 | Palace-6 | TCPUDP | — | safe | 0 |
02Palace-6tcp · udp · iana-registered · risk 1/10
TCP and UDP port 9997 is assigned to Palace-6, a service registered to Douglas Crockford; active use is not established.
port 9997 as Palace-6 →Which one is on your host
The registry says what 9997 is registered to. What is listening on it right now is decided by the host, and only the host can be asked. Each of these prints the process behind the socket.
- linux
ss -ltnp | grep ':9997\b'- macos
lsof -nP -iTCP:9997 -sTCP:LISTEN- windows
netstat -ano | findstr :9997
On Linux and Windows the process name comes back with the socket; on macOS lsof needs sudo to name a process that isn't yours. Match what it prints against the 2 entries above.
A port number is not a service. Anything may listen on 9997 — what you actually met is decided by the host, not the registry. If a service is missing here, it belongs in the registry.
contribute an entry