# WHATPORT(135)

## NAME

port 135 — MSRPC endpoint mapper (epmap) — Windows RPC endpoint mapper — ask it where a service lives and it hands back a dynamic port.

Protocol: TCP/UDP  
IANA registry

## DESCRIPTION

Registered as `epmap`, DCE endpoint resolution, this is in practice the Microsoft RPC endpoint mapper. A client that wants an RPC interface asks 135 for its binding and is sent on to a dynamically assigned high port, which is why 135 is inseparable from the 49152–65535 range on Windows. WMI, DCOM, Exchange, the print spooler and countless management tools depend on it. It is open on essentially every Windows host, and it was the port the Blaster worm entered through in 2003.

## EXPOSURE

**Do not expose.** An internet-facing endpoint mapper enumerates RPC interfaces and is a decades-long source of remote code execution bugs. ISPs commonly block 135 outright.

## CHECK

```sh
nc -vz TARGET 135
```

## SEE ALSO

- docs — [MS-RPCE — Remote Procedure Call Protocol Extensions](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15) (learn.microsoft.com)
- docs — [Service overview and network port requirements for Windows](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements) (learn.microsoft.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/135/> · JSON: <https://whatport.net/135.json> · full dataset: <https://whatport.net/ports.json>