{
  "port": 49153,
  "protocol": "tcp",
  "service": "Dynamic/ephemeral port (Windows RPC)",
  "oneLiner": "The second slot in the dynamic range — on Windows, usually another RPC endpoint.",
  "whatItIs": "49153 has no registration and never will: RFC 6335 reserves 49152-65535 for dynamic use only. On Windows Server 2008 and later, services that ask RPC for a port are allocated from the bottom of that range, so 49153 is typically the second such endpoint and appears alongside 49152 on nearly every Windows host. Which service holds it is not fixed — it depends on start order — so map it rather than assume it.",
  "exposure": {
    "verdict": "never",
    "note": "MSRPC endpoints are the same attack surface as port 135 and are not designed to face the internet; restrict the range at the perimeter."
  },
  "checkCommand": "sudo lsof -nP -iTCP:49153 -sTCP:LISTEN",
  "links": [
    {
      "title": "Microsoft — Service overview and network port requirements (RPC randomly allocated high ports 49152-65535)",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements",
      "kind": "official-docs"
    },
    {
      "title": "RFC 6335 — Dynamic Ports 49152-65535",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    }
  ]
}