{
  "port": 49155,
  "protocol": "tcp",
  "service": "Dynamic/ephemeral port (Windows RPC)",
  "oneLiner": "Still inside the dynamic range; the deeper into it a host goes, the more RPC services it is running.",
  "whatItIs": "49155 carries no assignment — RFC 6335 forbids one in this range — and shows up mainly on Windows hosts that have allocated several RPC endpoints at boot. Nmap sees it open on about 0.6% of scanned hosts, a little less often than 49152-49154, which tracks how many services a typical machine registers. macOS and other BSD-derived systems start their ephemeral allocation at 49152 too, so outbound connections from those hosts also occupy this number.",
  "exposure": {
    "verdict": "never",
    "note": "An RPC endpoint or an ephemeral client socket — neither is something to publish; block the range inbound at the edge."
  },
  "checkCommand": "nmap -sV -Pn -p 49155 TARGET",
  "links": [
    {
      "title": "RFC 6335 — Dynamic Ports 49152-65535 (never assigned)",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    },
    {
      "title": "Microsoft — Service overview and network port requirements (RPC high port range)",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements",
      "kind": "official-docs"
    },
    {
      "title": "nmap/nmap — nmap-services (port frequency database)",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}