Port 9997 – Splunk Forwarder

TCP

Port 9997 is the default Splunk receiving port where indexers accept data from Universal and Heavy Forwarders. Forwarders send compressed, encrypted log data to indexers on port 9997. This is a data ingestion port – it does not provide administrative access but carries all forwarded log data.

Port Number

9997

Protocol

TCP

Service

Splunk Forwarding (Receiving)

Range

IANA Registered (1024–49151)

Description

Splunk indexers listen on port 9997 to receive data from Splunk Universal Forwarders deployed across the infrastructure. Forwarders compress and optionally encrypt data before transmission. The receiving port supports both Splunk-to-Splunk protocol (proprietary binary) and cooked data formats. Port 9997 is the primary data flow path in Splunk architecture – all logs, metrics, and events from monitored systems pass through it. While it does not provide administrative access, compromising this port enables: data injection (polluting the index with false events), data interception (if SSL is not enabled), and denial of service (flooding the indexer). Enable SSL between forwarders and indexers (outputs.conf: sslCertPath, sslRootCAPath) and restrict port 9997 to known forwarder IPs.

Security risks

1Log injection – without certificate-based authentication, any host can send forged events to port 9997. Injected logs can trigger false alerts, hide real attacks, or poison SIEM correlation rules.
2Cleartext data exfiltration – if SSL is not enabled (sslCertPath not set in outputs.conf), all forwarded logs transit the network unencrypted. Credentials, PII, and security events are visible to any network observer.
3Indexer denial of service – flooding port 9997 with high-volume garbage data fills indexer disk quotas and license limits, causing legitimate log loss during the overflow.
4Credential harvesting from forwarded data – logs often contain plaintext passwords, API keys, and tokens. Intercepting the forwarder-to-indexer stream gives an attacker credentials from every monitored system.

Firewall guidance

Restrict port 9997 inbound to known forwarder IPs or management subnets only. Enable TLS mutual authentication (server.conf: [sslConfig] requireClientCert=true) so only forwarders with valid certificates can send data. In cloud environments, use security groups referencing the forwarder tier's group rather than IP ranges.

Diagnosis commands

Show configured forwarder-to-indexer connections and their status

shell

splunk list forward-server

Verify the Splunk indexer is listening and confirm the process

shell

ss -tlnp sport = :9997

Check recent forwarder connections and data receipt

shell

splunk search 'index=_internal sourcetype=splunkd component=TcpInputProc' -earliest=-15m

Verify TLS is active on the receiving port

shell

openssl s_client -connect indexer:9997

Usage examples

Port 9997 – Splunk Forwarder

shell

outputs.conf: [tcpout] server=indexer:9997
inputs.conf: [splunktcp://9997] (on indexer)
splunk list forward-server (shows forwarder->indexer connections)

Common services on this port

Splunk IndexerSplunk Heavy Forwarder (intermediate)Splunk Cluster Peer

Related ports

8089

Splunk management API (splunkd REST)

9998

Splunk replication (indexer clustering)

514

Syslog (alternative log ingestion)

8088

Splunk HEC (HTTP Event Collector)

History

Splunk chose port 9997 as the default receiving port in Splunk 4.x (2009) to avoid conflicts with its management port (8089) and web UI (8000). The Splunk-to-Splunk protocol is proprietary binary – compressed, optionally encrypted, with built-in acknowledgment for reliable delivery. The port has remained the de facto standard across all Splunk deployment architectures.

FAQ

How do I enable TLS between Splunk forwarders and indexers?

On the indexer: set sslCertPath, sslPassword, and requireClientCert=true in inputs.conf under [splunktcp-ssl:9997]. On each forwarder: set sslCertPath, sslRootCAPath, and sslPassword in outputs.conf under [tcpout]. Both sides need certs signed by the same CA. Restart both after changes.

Can an attacker inject false logs into Splunk via port 9997?

Yes, if the port accepts unauthenticated connections (the default without TLS client certs). An attacker on the same network can speak the Splunk forwarding protocol and inject events into any index the receiving port is configured to accept. Enable requireClientCert to prevent this.