# WHATPORT(1025)

## NAME

port 1025 — Windows dynamic RPC endpoint — IANA: blackjack — Registered as "network blackjack", but the reason it is so often open is Windows: the first dynamic RPC port on older releases.

Protocol: TCP  
IANA: blackjack

## DESCRIPTION

IANA's assignment is blackjack, a joke-grade legacy registration with no specification behind it. The reason 1025 is by far the most frequently open port in this neighbourhood in nmap's data is Microsoft: on Windows 2000, XP and Server 2003 the default dynamic port range ran 1025–5000, so the first service to ask the RPC endpoint mapper for a port landed on 1025 — which is why scanners label it "NFS-or-IIS". Windows Vista and Server 2008 moved the range to 49152–65535, so on a current host a listening 1025 is more likely an application that chose it.

## EXPOSURE

**Do not expose.** As a Windows RPC endpoint this is a broadly-capable interface with a long history of remotely-exploitable bugs, and it is under constant untargeted scanning. RPC does not belong on the internet; reach it over a VPN.

## CHECK

```sh
nc -vz -w 3 TARGET 1025
```

## SEE ALSO

- docs — [Microsoft — Service overview and network port requirements (dynamic range 1025–5000 on pre-Vista Windows)](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements) (learn.microsoft.com)
- iana — [IANA port registry — 1025](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1025) (iana.org)
- source — [nmap-services (1025/tcp NFS-or-IIS | blackjack)](https://github.com/nmap/nmap/blob/master/nmap-services) (github.com)

---

HTML: <https://whatport.net/1025/> · JSON: <https://whatport.net/1025.json> · full dataset: <https://whatport.net/ports.json>