# Lots of open ports and traffic towards elasticsearch

**URL:** <https://discuss.elastic.co/t/lots-of-open-ports-and-traffic-towards-elasticsearch/311835>\
**Category:** Kibana\
**Created:** [August 10, 2022, 1:14pm UTC](https://discuss.elastic.co/t/lots-of-open-ports-and-traffic-towards-elasticsearch/311835 "2022-08-10T13:14:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mark\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_s/32/98686_2.png) [@Mark\_S](https://discuss.elastic.co/u/Mark_S)\
**Post date:** [August 10, 2022, 1:14pm UTC](https://discuss.elastic.co/t/lots-of-open-ports-and-traffic-towards-elasticsearch/311835/1 "2022-08-10T13:14:53Z")

</div>

I have logstash, kibana on one server and another one runs elasticsearch. I have three open pipelines collecting logfile data.

I noticed a lot of open ports (277 established TCP connections in the range 45000 - 55000).

1. Is this normal?
2. Is there a way to reduce the requests rate e.g. via stack motinoring/advanced settings? Or is this proportional to the incoming log data rate and cannot be adjusted (perhaps via delays in logstash?)

With tcpdump I can see that the traffic consists of similar packets per port. As if it is some sort of keep-alive check ... There must be a way to reduce the frequency of these messages  
Example of what is transmitted on one of the ports ( note that SERVER02.wap-wsp is SERVER02.9200, that is elasticsearch port that gets translated to wap-wsp from tcpdump)

```auto
sudo tcpdump -A -i any port 50122

dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes

18:09:29.097289 IP SERVER01.50122 > SERVER02.wap-wsp: Flags [.], ack 1020159173, win 1424, options [nop,nop,TS val 1521411063 ecr 4108180594], length 0
E..4'.@.@.............#....O<.d.....^%.....
Z......r
18:09:29.097617 IP SERVER02.wap-wsp > SERVER01.50122: Flags [.], ack 1, win 3433, options [nop,nop,TS val 4108181618 ecr 1521373219], length 0
E..4..@.@.B.........#...<.d....P...i.......
...rZ.P#
18:09:30.121265 IP SERVER01.50122 > SERVER02.wap-wsp: Flags [.], ack 1, win 1424, options [nop,nop,TS val 1521412087 ecr 4108181618], length 0
E..4'.@.@.............#....O<.d.....^%.....
Z......r
18:09:30.121568 IP SERVER02.wap-wsp > SERVER01.50122: Flags [.], ack 1, win 3433, options [nop,nop,TS val 4108182642 ecr 1521373219], length 0
E..4..@.@.B.........#...<.d....P...i.......
...rZ.P#
18:09:31.145316 IP SERVER01.50122 > SERVER02.wap-wsp: Flags [.], ack 1, win 1424, options [nop,nop,TS val 1521413111 ecr 4108182642], length 0
E..4'.@.@.............#....O<.d.....^%.....
Z......r

```

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [August 10, 2022, 1:48pm UTC](https://discuss.elastic.co/t/lots-of-open-ports-and-traffic-towards-elasticsearch/311835/2 "2022-08-10T13:48:58Z")

</div>

277 is nothing. I have in 100k open connection on heavy system.

---

<div class="post-metadata">

**Author:** ![Mark\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_s/32/98686_2.png) [@Mark\_S](https://discuss.elastic.co/u/Mark_S)\
**Post date:** [August 10, 2022, 1:53pm UTC](https://discuss.elastic.co/t/lots-of-open-ports-and-traffic-towards-elasticsearch/311835/3 "2022-08-10T13:53:41Z")

</div>

Thanks -that's good to know! (I guess you mean 10k)

But is there any way to control the total request rate?

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [August 10, 2022, 2:09pm UTC](https://discuss.elastic.co/t/lots-of-open-ports-and-traffic-towards-elasticsearch/311835/4 "2022-08-10T14:09:08Z")

</div>

I didn't find anything yet to reduce the rate

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 7, 2022, 2:09pm UTC](https://discuss.elastic.co/t/lots-of-open-ports-and-traffic-towards-elasticsearch/311835/5 "2022-09-07T14:09:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.