# WHATPORT(1026)

## NAME

port 1026 — CAP (Calendar Access Protocol) / Windows dynamic RPC — Registered to the experimental Calendar Access Protocol, but in practice it is almost always a dynamically assigned Windows RPC endpoint.

Protocol: TCP/UDP  
IANA registry

## DESCRIPTION

IANA assigns 1026 to `cap`, the Calendar Access Protocol, an experimental protocol (RFC 4324, 2005) that carried iCalendar operations over BEEP; the RFC names 1026 as the default port a Calendar Store listens on. CAP was never widely implemented and you will effectively never meet one. What you do meet on 1026 is a Windows box: Windows 2000, XP and Server 2003 allocated dynamic RPC and DCOM endpoints out of a low range starting at 1025, so 1026 is one of the first ports handed to whatever RPC service starts early, and nmap fingerprints it as `msrpc`. Vista and Server 2008 moved that range to 49152-65535, so a modern host answering here is running something else entirely.

## EXPOSURE

**Do not expose.** The realistic listener is a Windows DCE/RPC endpoint, which has no business on a public IP; and since the binding is dynamic you cannot know what service is behind it without asking the endpoint mapper on 135.

## CHECK

```sh
nmap -Pn -sV -p 1026 TARGET
```

## SEE ALSO

- spec — [RFC 4324 — Calendar Access Protocol (CAP)](https://www.rfc-editor.org/rfc/rfc4324.html) (rfc-editor.org)
- docs — [Microsoft — Service overview and network port requirements (dynamic port ranges)](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements) (learn.microsoft.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/1026/> · JSON: <https://whatport.net/1026.json> · full dataset: <https://whatport.net/ports.json>