{
  "port": 49156,
  "protocol": "tcp",
  "service": "Dynamic/ephemeral port (Windows RPC)",
  "oneLiner": "A dynamic port that mostly turns up on busier Windows servers and domain controllers.",
  "whatItIs": "49156 is in the IANA dynamic range, so it has no registered owner and any service here was assigned the port at runtime. In practice it is a Windows RPC endpoint on a host running enough services to reach this far up the pool, which is why domain controllers commonly show a run of 49152 through 49157 open while a workstation shows only the first two or three. Nmap records it open on roughly 0.5% of hosts.",
  "exposure": {
    "verdict": "never",
    "note": "A long unbroken run of open ports from 49152 is a Windows server signature; that whole range should be reachable only from inside the network."
  },
  "checkCommand": "nmap -sV -Pn -p 49152-49157 TARGET",
  "links": [
    {
      "title": "Microsoft — Service overview and network port requirements (dynamic RPC ports)",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements",
      "kind": "official-docs"
    },
    {
      "title": "RFC 6335 — Dynamic Ports 49152-65535",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    }
  ]
}