# WHATPORT(49161)

## NAME

port 49161 — Dynamic / ephemeral (commonly Windows RPC) — Unregistered high port; a Windows RPC service listening here is the common explanation.

Protocol: TCP

## DESCRIPTION

Nothing is registered at 49161 and nothing can be: RFC 6335 places 49152-65535 in the Dynamic Ports range, outside IANA assignment. Windows RPC servers bind ports from this range at service start and register the mapping with the endpoint mapper on TCP 135, which is the only reliable way to name what is listening. Because allocation is first-come, the same service will sit on a different number after the next reboot, so firewall rules written against a specific port here break.

## EXPOSURE

**Do not expose.** If a service genuinely needs to be reachable, pin it to a fixed registered port and allow that instead of opening a dynamic range to untrusted networks.

## CHECK

```sh
sudo lsof -nP -iTCP:49161 -sTCP:LISTEN
```

## SEE ALSO

- spec — [RFC 6335 — IANA Procedures for Service Name and Transport Protocol Port Number Registry](https://www.rfc-editor.org/rfc/rfc6335.html) (rfc-editor.org)
- docs — [Microsoft KB 929851 — Default dynamic port range for TCP/IP](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/default-dynamic-port-range-tcpip-chang) (learn.microsoft.com)

---

HTML: <https://whatport.net/49161/> · JSON: <https://whatport.net/49161.json> · full dataset: <https://whatport.net/ports.json>