The second slot in the dynamic range — on Windows, usually another RPC endpoint.
49153 has no registration and never will: RFC 6335 reserves 49152-65535 for dynamic use only. On Windows Server 2008 and later, services that ask RPC for a port are allocated from the bottom of that range, so 49153 is typically the second such endpoint and appears alongside 49152 on nearly every Windows host. Which service holds it is not fixed — it depends on start order — so map it rather than assume it.
Do not expose
MSRPC endpoints are the same attack surface as port 135 and are not designed to face the internet; restrict the range at the perimeter.
$ sudo lsof -nP -iTCP:49153 -sTCP:LISTENSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.