# WHATPORT(49155)

## NAME

port 49155 — Dynamic/ephemeral port (Windows RPC) — Still inside the dynamic range; the deeper into it a host goes, the more RPC services it is running.

Protocol: TCP

## DESCRIPTION

49155 carries no assignment — RFC 6335 forbids one in this range — and shows up mainly on Windows hosts that have allocated several RPC endpoints at boot. Nmap sees it open on about 0.6% of scanned hosts, a little less often than 49152-49154, which tracks how many services a typical machine registers. macOS and other BSD-derived systems start their ephemeral allocation at 49152 too, so outbound connections from those hosts also occupy this number.

## EXPOSURE

**Do not expose.** An RPC endpoint or an ephemeral client socket — neither is something to publish; block the range inbound at the edge.

## CHECK

```sh
nmap -sV -Pn -p 49155 TARGET
```

## SEE ALSO

- spec — [RFC 6335 — Dynamic Ports 49152-65535 (never assigned)](https://www.rfc-editor.org/rfc/rfc6335.html) (rfc-editor.org)
- docs — [Microsoft — Service overview and network port requirements (RPC high port range)](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements) (learn.microsoft.com)
- source — [nmap/nmap — nmap-services (port frequency database)](https://github.com/nmap/nmap/blob/master/nmap-services) (github.com)

---

HTML: <https://whatport.net/49155/> · JSON: <https://whatport.net/49155.json> · full dataset: <https://whatport.net/ports.json>