{
  "port": 49158,
  "protocol": "tcp",
  "service": "Dynamic / ephemeral (commonly Windows RPC)",
  "oneLiner": "Unassignable dynamic port; on a Windows scan it is almost always an RPC endpoint handed out by the endpoint mapper.",
  "whatItIs": "49158 sits inside 49152-65535, the Dynamic/Private range that RFC 6335 says cannot be assigned through IANA and must not be used as a service identifier. Windows Vista and Server 2008 moved the default dynamic client port range to 49152-65535 (KB 929851), so RPC-based Windows services grab numbers here at startup unless an administrator pins them. A scan showing 49158 open on a Windows host means some RPC interface is listening; which one is only answerable by asking the endpoint mapper on port 135, and the answer can change after a reboot.",
  "exposure": {
    "verdict": "never",
    "note": "Windows RPC endpoints in this range should not face the internet. Microsoft's port-requirements guidance expects 49152-65535 to be reachable only between servers inside a segmented network."
  },
  "checkCommand": "nmap -Pn -sV -p 135,49158 TARGET",
  "links": [
    {
      "title": "RFC 6335 — IANA Procedures for Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    },
    {
      "title": "Microsoft KB 929851 — The default dynamic port range for TCP/IP has changed in Windows Vista and Windows Server 2008",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/default-dynamic-port-range-tcpip-chang",
      "kind": "official-docs"
    },
    {
      "title": "Microsoft — Service overview and network port requirements for Windows",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements",
      "kind": "official-docs"
    }
  ]
}