# WHATPORT(49158)

## NAME

port 49158 — Dynamic / ephemeral (commonly Windows RPC) — Unassignable dynamic port; on a Windows scan it is almost always an RPC endpoint handed out by the endpoint mapper.

Protocol: TCP

## DESCRIPTION

49158 sits inside 49152-65535, the Dynamic/Private range that RFC 6335 says cannot be assigned through IANA and must not be used as a service identifier. Windows Vista and Server 2008 moved the default dynamic client port range to 49152-65535 (KB 929851), so RPC-based Windows services grab numbers here at startup unless an administrator pins them. A scan showing 49158 open on a Windows host means some RPC interface is listening; which one is only answerable by asking the endpoint mapper on port 135, and the answer can change after a reboot.

## EXPOSURE

**Do not expose.** Windows RPC endpoints in this range should not face the internet. Microsoft's port-requirements guidance expects 49152-65535 to be reachable only between servers inside a segmented network.

## CHECK

```sh
nmap -Pn -sV -p 135,49158 TARGET
```

## SEE ALSO

- spec — [RFC 6335 — IANA Procedures for Service Name and Transport Protocol Port Number Registry](https://www.rfc-editor.org/rfc/rfc6335.html) (rfc-editor.org)
- docs — [Microsoft KB 929851 — The default dynamic port range for TCP/IP has changed in Windows Vista and Windows Server 2008](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/default-dynamic-port-range-tcpip-chang) (learn.microsoft.com)
- docs — [Microsoft — Service overview and network port requirements for Windows](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements) (learn.microsoft.com)

---

HTML: <https://whatport.net/49158/> · JSON: <https://whatport.net/49158.json> · full dataset: <https://whatport.net/ports.json>