Windows RPC endpoint mapper — ask it where a service lives and it hands back a dynamic port.
Registered as epmap, DCE endpoint resolution, this is in practice the Microsoft RPC endpoint mapper. A client that wants an RPC interface asks 135 for its binding and is sent on to a dynamically assigned high port, which is why 135 is inseparable from the 49152–65535 range on Windows. WMI, DCOM, Exchange, the print spooler and countless management tools depend on it. It is open on essentially every Windows host, and it was the port the Blaster worm entered through in 2003.
Do not expose
An internet-facing endpoint mapper enumerates RPC interfaces and is a decades-long source of remote code execution bugs. ISPs commonly block 135 outright.
$ nc -vz TARGET 135Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.