Puzzling. I think at this point I'd break out the heavy machinery of `tcpdump`, capture a successful connection via `telnet` and an unsuccessful one by Elasticsearch and see if I could spot any differences.

---