{
  "port": 49167,
  "protocol": "tcp",
  "service": "Dynamic / ephemeral (commonly Windows RPC)",
  "oneLiner": "No registration exists; a listener here is typically a Windows RPC service, and the port number is not stable.",
  "whatItIs": "49167 is Dynamic/Private space under RFC 6335, so no service name is or can be attached to it. Windows Server assigns RPC endpoints from 49152-65535 in the order services start, meaning the exact number is an artifact of boot ordering rather than a property of the service. That is why the honest answer to \"what is on 49167\" is always a query to the endpoint mapper on TCP 135 or a look at the local process table, never a lookup table.",
  "exposure": {
    "verdict": "never",
    "note": "Do not publish dynamic RPC ports; if remote administration is needed, front it with a VPN rather than opening the range."
  },
  "checkCommand": "sudo lsof -nP -iTCP:49167 -sTCP:LISTEN",
  "links": [
    {
      "title": "RFC 6335 — IANA Procedures for Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    },
    {
      "title": "Microsoft — Service overview and network port requirements for Windows",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements",
      "kind": "official-docs"
    }
  ]
}