# WHATPORT(49163)

## NAME

port 49163 — Dynamic / ephemeral (commonly Windows RPC) — Dynamic-range port, no IANA owner; usually one of a Windows host's RPC listeners.

Protocol: TCP

## DESCRIPTION

49163 falls in the Dynamic/Private range that RFC 6335 sets aside for local use and bars from registration. On Windows it is ordinary for several RPC-backed services — Netlogon, DFS Replication, certificate services, WMI and others — to occupy scattered ports across 49152-65535, and Microsoft's own port-requirements documentation lists that whole range as the requirement rather than naming individual numbers. On a scan, an open 49163 next to open 135 is the signature of Windows RPC rather than of any particular product.

## EXPOSURE

**Do not expose.** Microsoft documents this range as internal server-to-server traffic; exposing it publicly exposes the RPC surface behind it.

## CHECK

```sh
nmap -Pn -sV -p 135,49163 TARGET
```

## SEE ALSO

- docs — [Microsoft — Service overview and network port requirements for Windows](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements) (learn.microsoft.com)
- spec — [RFC 6335 — IANA Procedures for Service Name and Transport Protocol Port Number Registry](https://www.rfc-editor.org/rfc/rfc6335.html) (rfc-editor.org)

---

HTML: <https://whatport.net/49163/> · JSON: <https://whatport.net/49163.json> · full dataset: <https://whatport.net/ports.json>