# WHATPORT(49159)

## NAME

port 49159 — Dynamic / ephemeral (commonly Windows RPC) — No IANA assignment exists here; a listener on 49159 is typically a Windows RPC service that took the next free dynamic port.

Protocol: TCP  
IANA registry

## DESCRIPTION

The IANA registry stops at 49151. Everything from 49152 up is Dynamic/Private space that RFC 6335 explicitly excludes from assignment, so no service owns 49159 and none can. Windows allocates RPC server endpoints from this range in ascending order as services start, which is why domain controllers and file servers frequently show a cluster of open ports in the low 49150s and 49160s. Outside Windows the same number turns up as a client-side source port for an outbound connection, in which case nothing is listening at all.

## EXPOSURE

**Do not expose.** An unidentified high-port listener should not be exposed until you know which RPC interface answers on it; enumerate it from port 135 first.

## CHECK

```sh
sudo lsof -nP -iTCP:49159 -sTCP:LISTEN
```

## SEE ALSO

- spec — [RFC 6335 — IANA Procedures for Service Name and Transport Protocol Port Number Registry](https://www.rfc-editor.org/rfc/rfc6335.html) (rfc-editor.org)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)
- docs — [Microsoft KB 929851 — Default dynamic port range for TCP/IP](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/default-dynamic-port-range-tcpip-chang) (learn.microsoft.com)

---

HTML: <https://whatport.net/49159/> · JSON: <https://whatport.net/49159.json> · full dataset: <https://whatport.net/ports.json>