{
  "port": 49163,
  "protocol": "tcp",
  "service": "Dynamic / ephemeral (commonly Windows RPC)",
  "oneLiner": "Dynamic-range port, no IANA owner; usually one of a Windows host's RPC listeners.",
  "whatItIs": "49163 falls in the Dynamic/Private range that RFC 6335 sets aside for local use and bars from registration. On Windows it is ordinary for several RPC-backed services — Netlogon, DFS Replication, certificate services, WMI and others — to occupy scattered ports across 49152-65535, and Microsoft's own port-requirements documentation lists that whole range as the requirement rather than naming individual numbers. On a scan, an open 49163 next to open 135 is the signature of Windows RPC rather than of any particular product.",
  "exposure": {
    "verdict": "never",
    "note": "Microsoft documents this range as internal server-to-server traffic; exposing it publicly exposes the RPC surface behind it."
  },
  "checkCommand": "nmap -Pn -sV -p 135,49163 TARGET",
  "links": [
    {
      "title": "Microsoft — Service overview and network port requirements for Windows",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements",
      "kind": "official-docs"
    },
    {
      "title": "RFC 6335 — IANA Procedures for Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    }
  ]
}