{
  "port": 49152,
  "protocol": "both",
  "service": "Dynamic/ephemeral range start (Windows RPC, UPnP)",
  "oneLiner": "The first port of the dynamic range — on Windows the first RPC service to ask for a port gets it.",
  "whatItIs": "RFC 6335 sets aside 49152-65535 as Dynamic/Private ports that IANA never assigns, and both Windows (Vista/Server 2008 and later) and macOS start their ephemeral allocation exactly here. That makes 49152 the single most commonly open port in the range: it is the first slot handed to an RPC service on a Windows box, and consumer routers frequently land their UPnP IGD HTTP endpoint on it for the same reason. Nmap measures it open on about 0.8% of hosts on TCP and far more on UDP, which is why it appears on almost every Windows scan.",
  "exposure": {
    "verdict": "never",
    "note": "Whatever occupies it — MSRPC or a router's UPnP control endpoint — is internal machinery with no business on a public IP; Microsoft's guidance is to allow the range only inside the network."
  },
  "checkCommand": "nmap -sV -Pn -p 49152 TARGET",
  "links": [
    {
      "title": "RFC 6335 — Dynamic Ports 49152-65535 (never assigned)",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    },
    {
      "title": "Microsoft — Service overview and network port requirements (dynamic range 49152-65535)",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements",
      "kind": "official-docs"
    },
    {
      "title": "nmap/nmap — nmap-services (port frequency database)",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}