# WHATPORT(49167)

## NAME

port 49167 — Dynamic / ephemeral (commonly Windows RPC) — No registration exists; a listener here is typically a Windows RPC service, and the port number is not stable.

Protocol: TCP

## DESCRIPTION

49167 is Dynamic/Private space under RFC 6335, so no service name is or can be attached to it. Windows Server assigns RPC endpoints from 49152-65535 in the order services start, meaning the exact number is an artifact of boot ordering rather than a property of the service. That is why the honest answer to "what is on 49167" is always a query to the endpoint mapper on TCP 135 or a look at the local process table, never a lookup table.

## EXPOSURE

**Do not expose.** Do not publish dynamic RPC ports; if remote administration is needed, front it with a VPN rather than opening the range.

## CHECK

```sh
sudo lsof -nP -iTCP:49167 -sTCP:LISTEN
```

## SEE ALSO

- spec — [RFC 6335 — IANA Procedures for Service Name and Transport Protocol Port Number Registry](https://www.rfc-editor.org/rfc/rfc6335.html) (rfc-editor.org)
- docs — [Microsoft — Service overview and network port requirements for Windows](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements) (learn.microsoft.com)

---

HTML: <https://whatport.net/49167/> · JSON: <https://whatport.net/49167.json> · full dataset: <https://whatport.net/ports.json>