> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/controllers/controller-6000/troubleshoot/controller-6000-testing-controller-connections.md). # Test controller connections Test Controller 6000 network connectivity, server communication, port 1072, and diagnostics. > The majority of testing on this page is best done **from the Controller network connection point** using a laptop, back to the server. From v9.30 onwards the controller is capable of performing this function itself (see Network Connectivity Tools below). > Ideally the laptop would be configured the same as the Controller being tested and plugged into the same network connection point. > ⚠️ From CC v8.50 onwards the **controller is the device that makes the initial TCP connection to the server**. The server does not send any TCP connection request to the controller. *** ## Ping ``` C:\>ping C:\>ping ``` If a reply is received, this proves there is a network connection to the controller or server. It also adds an entry to the **ARP cache** (required before running ARP). May fail if: * No route to the controller. * The site network is configured to disable ICMP (which `ping` uses). * Ping traffic is specifically blocked. Also check the **Link Light** at the Ethernet connection of the controller. The green LED next to the Ethernet adapter should be on solid. > 💡 If `ping` returns an IPv6 address but you want IPv4, use the `-4` switch: `C:\>ping -4 ` > 💡 If the controller is on a different subnet to the server, the **switch the controller is plugged into must reply to pings**. The controller pings the gateway to ensure a connection before transmitting data to the server. *** ## Listen Port By default the port controllers communicate on is **Port 1072**. This is defined as the **Listen Port** in the Gallagher Registry. Unless you have a specific reason for setting a unique Listen Port, **1072** is used on installing Command Centre. > ⚠️ If the site is using a non-standard listen port, the controller must **first connect** to the server to pick up the custom communication port. *** ## Telnet ``` C:\>telnet 1072 ``` Tests TCP Port 1072 (used for controller-server and controller-controller communication). **Must be run in both directions.** > ⚠️ From v8.50 upwards, controllers communicate **only outbound** to the server on the Listen Port (1072 by default). The server **no longer** reaches out to the controller. If you get `"'telnet' is not recognized as an internal or external command..."`, install Telnet from **Turn Windows features on or off** in Control Panel, Programs and Features. Install both **Telnet Client** and **Telnet Server**. Indications: * **OK (1):** Screen blanks; cursor stays flashing top-left. The port is open. * **OK (2):** Cursor returns to `C:` prompt. The port is open (you may also see "connection lost"; it may also raise an alarm if the controller is online). * **FAIL:** Port is blocked. Check: (1) Firewall, (2) Switch/router IT policy, (3) Anti-virus (some anti-virus prevents controller connections, disable temporarily to test). *** ## Telnet alternative - Test-NetConnection (TNC) 1. Open **PowerShell** (Admin privileges not required). 2. Run: ```powershell PS C:\Users\Gallagher> tnc -p ``` Advantages over Telnet: 1. You do not have to install the Telnet client on Windows machines. 2. You can check the **Server IP address** and **Network Adaptor** used to communicate with the Controllers or target device. *** ## Network Connectivity Tools (firmware v9.30+) Available from controller **firmware v9.30 onwards**. From within the controller's web pages (Web Config and Debug pages) there is a utility link called **Network connectivity tools**. By default it has the default Gallagher Controller Service listen port, **1072**. 1. Enter the Server's IP address into the Address window. 2. Click **`ConnectToIPAddress`**. On the C6000 the tool is launched from the controller's web pages (Web Config / Debug): ![Network connectivity tools as launched from the C6000 controller web pages](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-d5f6fb7ffbc95c0f3a7752fdce0744b26936419b%2FSECHUB-C7000-NETWORKING-01-network-connectivity-tools.png?alt=media) ![Network Connectivity Tools landing page](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-9aed1370c132751710210543702e224e4cf5efc8%2FSECHUB-C7000-NETWORKING-02-network-connectivity-tools-dialog.png?alt=media) A **successful** connectivity check result: ![Network connectivity tools - successful connectivity check result](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-cf815f09783cd1bc4ed5a831323a3c86c0c04e7e%2FSECHUB-C7000-NETWORKING-04-network-connectivity-success.png?alt=media) A **failed** check (server not reachable on the port): ![Network connectivity tools - failed connectivity check result](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-fb34ffdef2e3eeea645215b3a4aa989df1e39711%2FSECHUB-C6000-TESTING-04-network-connectivity-tools-fail.png?alt=media) There is also a link to this utility on the **Debug** main page of the controller: ![Network connectivity tools link under the C6000 Debug menu](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-13a87fdc9101fc5488038041f774f441b59919ab%2FSECHUB-C6000-TESTING-05-network-connectivity-tools-debug.png?alt=media) *** ## ARP ``` C:\>arp -a ``` After pinging the controller, run ARP to ensure you are receiving a reply from an actual controller. Look for the Internet Address you pinged above. If the **Physical Address starts with `00-90-1d`**, it is a Gallagher controller. *** ## netstat ``` C:\>netstat -an C:\>netstat -ano ``` ### Results on CC v8.40 and below * **Two established connections:** * Item A: controller connected to server through TCP port 1072. * Item B: server connected to controller on TCP port 1072. ![netstat result on CC v8.40 and below showing two established connections](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-c59d1163fa2176ced81e5cc5438f9e6aacaac96e%2FSECHUB-C6000-TESTING-07.png?alt=media) Network routing should be discussed and checked with the network administrator if controllers are not reporting back. ### Results on CC v8.50 and above * **Only one connection** established (outbound from controller). This is due to the controller services change implemented in v8.50. ![netstat result on CC v8.50 and above showing single outbound connection](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-e3334d104c03516ab0d397348abc8949017716de%2FSECHUB-C6000-TESTING-08.png?alt=media) ### Server with port 1072 listening for Controller service The server is listening on port 1072, used by a 'service' with a **PID**. ![netstat -ano output showing port 1072 and associated PID](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-de7fd967c4643b2da91425d3a52855ce5b950fb3%2FSECHUB-C6000-TESTING-03-netstat-ano-port-1072.png?alt=media) Confirm via Windows Task Manager that the PID is used by the **'FT Controller Service'**. ![Windows Task Manager PID list confirming FT Controller Service PID](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-431d2b79fd195822a57281b04a0444b4f3aa2b0d%2FSECHUB-C6000-TESTING-04-task-manager-pid.png?alt=media) > ⚠️ **PID mismatch:** If the PID using port 1072 does **not** match the PID of 'FT Controller Service', another application or service is using (locking) port 1072, causing the controller not to come online. > > Two options: > > 1. Get the third-party application to change or stop using port 1072. > 2. Change the listen port of the server-controller communication to a custom port. ![netstat -ano showing unknown process holding port 1072](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-fb969a9af508e273f4591dbf8f26749d763f026c%2FSECHUB-C7000-TESTING-05-tcp-netstat-port-conflict.png?alt=media) *** ## Web Browsing If a controller is not coming online, web-browse the controller to confirm what IP configuration it is using. To web-browse: enter the controller's IP address followed by **`/debug.`** in the address bar. Note the trailing **full stop**, which is required. ``` http://172.16.243.56/debug. ``` A logon prompt appears: | Username | Password (controller state) | | ------------ | ------------------------------------------------------------------------------------------------------------------------------- | | `diagnostic` | `[REDACTED]` if controller is in **2-flash** state (default - contact Tech Support) | | `diagnostic` | `[REDACTED]` if controller is in **1-flash** state (site-specific value based on the Site Serial number - contact Tech Support) | | `diagnostic` | A **configured password** if running CC v8.40 or later | ### Key debug pages | Page | What it tells you | | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **TCPSender** | Primary page for confirming TCP IP settings. The main item to check is the **Server IP**. If it doesn't match the actual Server IP, the controller will not come online. Active sessions show if the server is connected to the controller. | | **TCPExchange** | Confirm keys and certificates are OK. Confirm the correct Master certificate is selected (should match the Certificate setting in the Controller/Setup tab). Active sessions show if the controller is connected to the server. | | **Errorlog** | Shows problems with the controller or connectivity issues. Check as a last resort. | | **Node Number** | Must match the node number in Command Centre. To view the node number in CC: open Controller Properties > Setup tab, hold **Ctrl** and **double-click** in a clear area of the Setup tab. A popup window shows the Node number. | ![Additional testing screenshot 6](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-a771cef74092e940dc07d5865b7dc93e3176bfef%2FSECHUB-C6000-TESTING-06.png?alt=media) *** 🔗 **Related** * [Bringing online and networking](/knowledge-hub/products/cc-hardware/controllers/controller-6000/configure/controller-6000-bringing-online-and-ne.md). The wider bringing-online workflow. * [Firewall Issues](/knowledge-hub/products/cc-hardware/controllers/controller-6000/troubleshoot/controller-6000-firewall-issues.md). What to check when a firewall keeps controllers offline. * [Controller Drops Offline Immediately After Coming Online](/knowledge-hub/products/cc-hardware/controllers/controller-6000/troubleshoot/controller-6000-controller-drops-offli.md). Using the TCP Sender page to diagnose drop-offs. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/controllers/controller-6000/troubleshoot/controller-6000-testing-controller-connections.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.