Port 135
DCE/RPC Endpoint Mapper
_Port 135 is primarily used by Microsoft RPC Endpoint Mapper, a crucial function for locating network services used by Windows systems and DCE/RPC frameworks. It facilitates communication between clients and available services by helping clients determine what dynamic ports specific RPC services are listening on._.
Technical Details
Port 135 is designated for the DCE/RPC Endpoint Mapper, which is fundamental to the operation of distributed computing environments — particularly within Windows networks. When a Remote Procedure Call (RPC) is initiated, it first contacts the Endpoint Mapper on port 135 to discover the dynamically-assigned port number for the specific service required. This applies to numerous RPC-based Microsoft services, including DCOM, MS Exchange, Active Directory, and more.
The Endpoint Mapper listens over both TCP and UDP, acting as a directory service for applications to publish and query network endpoints. It enables seamless client-server communication by providing the necessary network endpoint details, typically on dynamically allocated high-numbered ephemeral ports.
Distributed Computing Environment (DCE) RPC and Microsoft’s implementation use port 135 as the starting point for service discovery, after which the actual communication occurs through dynamically assigned ports negotiated by the mapper. This multi-port architecture underpins many core Windows administrative and service protocols.