TCP 49152
Synopsis
- Microsoft Windows (Vista/Server 2008 and later) uses TCP 49152 as part of its default dynamic RPC port range (49152–65535); Windows services such as Active Directory Domain Services, WMI/DCOM, and DFS Replication frequently open listeners on 49152/TCP.
- Software that relies on Windows RPC inherits this, so you’ll commonly see TCP 49152 used by Microsoft Exchange components (for RPC to domain controllers), System Center (e.g., Configuration Manager clients/agents), and Veeam Backup & Replication when talking to Windows hosts.
- Microsoft Teams and (some) Skype clients use the 49152–65535 range for media; when UDP is blocked, media can fall back to TCP, so 49152/TCP may appear in flows.
- Security note: Because 49152 lies in the Windows RPC dynamic range, attackers often probe it during lateral-movement attempts targeting exposed DCOM/WMI/AD RPC services, though it isn’t tied to a single specific exploit.
Observed activity
Last 30 days
Detailed chart