HTTPfy

Port 9997 (Splunk forwarder receiving)

Splunk indexers receive data from universal forwarders on 9997.

Registered (user) port, 1024-49151 TCP Monitoring and logging Do not expose to the internet

What port 9997 is used for

Splunk indexers receive data from universal forwarders on 9997.

Security: should port 9997 be open?

Do not expose to the internet. Use TLS and allow only your forwarders.

IANA assignment

Service nameProtoDescriptionAssigneeReference
palace-6 TCP Palace-6 Douglas Crockford -
palace-6 UDP Palace-6 Douglas Crockford -

Check what is listening on port 9997

Linux: is anything listening on TCP 9997?
sudo ss -tlnp 'sport = :9997'
Linux / macOS: which process owns the port
sudo lsof -nP -i :9997
Older Linux / BSD (net-tools)
sudo netstat -tlnp | grep ':9997 '
Windows (Command Prompt)
netstat -ano | findstr :9997
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 9997 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine
nc -vz -w 5 HOST 9997
From Windows
Test-NetConnection HOST -Port 9997

Block port 9997 in the firewall

ufw
sudo ufw deny 9997/tcp
iptables
sudo iptables -A INPUT -p tcp --dport 9997 -j DROP
nftables
sudo nft add rule inet filter input tcp dport 9997 drop
Windows Firewall
New-NetFirewallRule -DisplayName 'Block TCP 9997' -Direction Inbound -Protocol TCP -LocalPort 9997 -Action Block

Related ports

8089Splunk management5044Logstash Beats input9995palace-49996palace-59998distinct329999distinct

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.