Port 135 (Microsoft RPC endpoint mapper)

DCE/RPC endpoint mapper: Windows clients ask it which dynamic port (49152-65535) a service such as WMI, DCOM or AD replication listens on.

Well-known (system) port, 0-1023 TCPUDP Windows networking Do not expose to the internet

What port 135 is used for

DCE/RPC endpoint mapper: Windows clients ask it which dynamic port (49152-65535) a service such as WMI, DCOM or AD replication listens on.

Security: should port 135 be open?

Do not expose to the internet. Block at the perimeter. It exposes a lot of Windows attack surface and was the vector of the Blaster worm. Inside the network, limit it to the hosts that need it.

IANA assignment

Service nameProtoDescriptionAssigneeReference

epmap TCP DCE endpoint resolution Joe Pato -

epmap UDP DCE endpoint resolution Joe Pato -

Check what is listening on port 135

Linux: is anything listening on TCP 135?

sudo ss -tlnp 'sport = :135'

Linux: UDP 135

sudo ss -ulnp 'sport = :135'

Linux / macOS: which process owns the port

sudo lsof -nP -i :135

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':135 '

Windows (Command Prompt)

netstat -ano | findstr :135

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 135 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 135

From Windows

Test-NetConnection HOST -Port 135

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 135

Block port 135 in the firewall

ufw

sudo ufw deny 135/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 135 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 135 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 135' -Direction Inbound -Protocol TCP -LocalPort 135 -Action Block

ufw

sudo ufw deny 135/udp