# WHATPORT(49156)

## NAME

port 49156 — Dynamic/ephemeral port (Windows RPC) — A dynamic port that mostly turns up on busier Windows servers and domain controllers.

Protocol: TCP

## DESCRIPTION

49156 is in the IANA dynamic range, so it has no registered owner and any service here was assigned the port at runtime. In practice it is a Windows RPC endpoint on a host running enough services to reach this far up the pool, which is why domain controllers commonly show a run of 49152 through 49157 open while a workstation shows only the first two or three. Nmap records it open on roughly 0.5% of hosts.

## EXPOSURE

**Do not expose.** A long unbroken run of open ports from 49152 is a Windows server signature; that whole range should be reachable only from inside the network.

## CHECK

```sh
nmap -sV -Pn -p 49152-49157 TARGET
```

## SEE ALSO

- docs — [Microsoft — Service overview and network port requirements (dynamic RPC ports)](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements) (learn.microsoft.com)
- spec — [RFC 6335 — Dynamic Ports 49152-65535](https://www.rfc-editor.org/rfc/rfc6335.html) (rfc-editor.org)

---

HTML: <https://whatport.net/49156/> · JSON: <https://whatport.net/49156.json> · full dataset: <https://whatport.net/ports.json>