# WHATPORT(49152)

## NAME

port 49152 — Dynamic/ephemeral range start (Windows RPC, UPnP) — The first port of the dynamic range — on Windows the first RPC service to ask for a port gets it.

Protocol: TCP/UDP

## DESCRIPTION

RFC 6335 sets aside 49152-65535 as Dynamic/Private ports that IANA never assigns, and both Windows (Vista/Server 2008 and later) and macOS start their ephemeral allocation exactly here. That makes 49152 the single most commonly open port in the range: it is the first slot handed to an RPC service on a Windows box, and consumer routers frequently land their UPnP IGD HTTP endpoint on it for the same reason. Nmap measures it open on about 0.8% of hosts on TCP and far more on UDP, which is why it appears on almost every Windows scan.

## EXPOSURE

**Do not expose.** Whatever occupies it — MSRPC or a router's UPnP control endpoint — is internal machinery with no business on a public IP; Microsoft's guidance is to allow the range only inside the network.

## CHECK

```sh
nmap -sV -Pn -p 49152 TARGET
```

## SEE ALSO

- spec — [RFC 6335 — Dynamic Ports 49152-65535 (never assigned)](https://www.rfc-editor.org/rfc/rfc6335.html) (rfc-editor.org)
- docs — [Microsoft — Service overview and network port requirements (dynamic range 49152-65535)](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements) (learn.microsoft.com)
- source — [nmap/nmap — nmap-services (port frequency database)](https://github.com/nmap/nmap/blob/master/nmap-services) (github.com)

---

HTML: <https://whatport.net/49152/> · JSON: <https://whatport.net/49152.json> · full dataset: <https://whatport.net/ports.json>