# WHATPORT(49157)

## NAME

port 49157 — Dynamic/ephemeral port (Windows RPC) — The last of the low dynamic ports scanners bother to probe by default.

Protocol: TCP

## DESCRIPTION

49157 sits in the never-assigned dynamic range and, like its neighbours, is normally a Windows RPC endpoint handed out at service start. It is the tail of the block Nmap keeps in its default scan set, open on about 0.36% of hosts — less often than 49152 because fewer machines allocate that many endpoints. Anything above it in the range is scanned only when you ask for it explicitly.

## EXPOSURE

**Do not expose.** Same rule as the rest of the range: internal only, and pin services to static ports if you genuinely need a narrow firewall rule.

## CHECK

```sh
nmap -sV -Pn -p 49157 TARGET
```

## SEE ALSO

- spec — [RFC 6335 — Dynamic Ports 49152-65535 (never assigned)](https://www.rfc-editor.org/rfc/rfc6335.html) (rfc-editor.org)
- docs — [Microsoft — Service overview and network port requirements (RPC high port range)](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements) (learn.microsoft.com)
- source — [nmap/nmap — nmap-services (port frequency database)](https://github.com/nmap/nmap/blob/master/nmap-services) (github.com)

---

HTML: <https://whatport.net/49157/> · JSON: <https://whatport.net/49157.json> · full dataset: <https://whatport.net/ports.json>