# WHATPORT(49176)

## NAME

port 49176 — Dynamic / ephemeral (commonly Windows RPC) — Unassignable dynamic port; on Windows an RPC endpoint, otherwise an application that picked a high number.

Protocol: TCP

## DESCRIPTION

Like the rest of 49152-65535, 49176 cannot be registered with IANA and carries no protocol meaning. On Windows it is one more RPC listener allocated at service startup and resolvable only through the endpoint mapper on TCP 135. Nmap's services file lists it as unknown with a very low open-port frequency, so seeing it usually means you are scanning a specific Windows machine rather than encountering a widespread service.

## EXPOSURE

**Do not expose.** Identify the process behind it locally before deciding anything; until then it should stay closed at the perimeter.

## CHECK

```sh
sudo lsof -nP -iTCP:49176 -sTCP:LISTEN
```

## SEE ALSO

- spec — [RFC 6335 — IANA Procedures for Service Name and Transport Protocol Port Number Registry](https://www.rfc-editor.org/rfc/rfc6335.html) (rfc-editor.org)
- docs — [Microsoft KB 929851 — Default dynamic port range for TCP/IP](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/default-dynamic-port-range-tcpip-chang) (learn.microsoft.com)

---

HTML: <https://whatport.net/49176/> · JSON: <https://whatport.net/49176.json> · full dataset: <https://whatport.net/ports.json>