{
  "port": 49160,
  "protocol": "tcp",
  "service": "Dynamic / ephemeral (commonly Windows RPC)",
  "oneLiner": "Dynamic-range port with no registration; on Windows it is an RPC endpoint, elsewhere usually just an ephemeral source port.",
  "whatItIs": "49160 is in the Dynamic/Private range, which RFC 6335 reserves for local and dynamic use and closes to IANA assignment. Windows hosts since Server 2008 draw RPC listener ports from 49152-65535, so 49160 open on a Windows box is an RPC interface whose identity lives in the endpoint mapper, not in the port number. Linux and BSD do not use this range by default for ephemeral ports (Linux typically uses 32768-60999), so on a Unix host a listener here was configured deliberately by an application.",
  "exposure": {
    "verdict": "never",
    "note": "Treat an unknown dynamic-range listener as closed to the internet by default; the port number carries no contract about what is behind it."
  },
  "checkCommand": "nmap -Pn -p 49160 --script rpc-grind TARGET",
  "links": [
    {
      "title": "RFC 6335 — IANA Procedures for Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    },
    {
      "title": "Microsoft — Service overview and network port requirements for Windows",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements",
      "kind": "official-docs"
    }
  ]
}