whatportis.com
suggest an edit →

Port 135Microsoft EPMAP

Microsoft Endpoint Mapper (EPMAP), commonly operating on port 135, serves as the RPC (Remote Procedure Call) locator service. It allows clients to identify network services available on a Windows host, facilitating communication with components like DHCP, DNS, WINS, and Distributed Component Object Model (DCOM). By mapping UUIDs to network addresses, EPMAP acts as a directory, enabling dynamic discovery of RPC services essential for remote management and inter-process communication in Windows environments..

inSecurityRemote AccessNetwork ServicesSystem
transport
tcp · udp

2 transports registered

in transit
cleartext

payload readable on path

assignment
unofficial

used by convention

risk
4/10

caution

lookups
51,883

rank 20 of 993 · top 2%

1 other service is registered on port 135. compare all 2 →

Technical Details

what runs on :135

Port 135 is most widely known for hosting the Microsoft Endpoint Mapper (EPM), or DCE/RPC Locator service. It is a critical component of the Microsoft RPC architecture. This service maps UUIDs requested by a client to the network endpoints, allowing the client to discover where a particular RPC service is listening.

Operating in both TCP and UDP protocols, EPMAP listens on port 135 and is fundamental in enabling various distributed Microsoft services. When a client wishes to communicate with a service like the DHCP server, WINS, or the DNS server, it consults the EPMAP service to resolve the service’s endpoint information dynamically. This capability is essential to the underlying Windows network architecture and is heavily utilized by DCOM communications.

Besides core OS functions, many enterprise Microsoft applications and management tools also rely on port 135 for initial handshakes. After this initial discovery phase, most communications occur on dynamically assigned high-numbered ports negotiated via port 135’s RPC endpoint mapper.

Security Information

exposure of :135

risk score

4/ 10caution

worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.

security averages 3.8 across 216 ports — this one sits 0.2 above.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

unofficial

used by convention, not registered — what answers here varies by deployment

reachable over

tcp · udp

udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite

security overview

Common vulnerabilities:

  • Exploitation of port 135 has been the vector for major worms such as Blaster and Sasser, both targeting vulnerabilities in RPC services accessible via this port.
  • Attackers often employ port scanning to locate hosts with exposed port 135, then exploit unpatched RPC services for remote code execution.
  • The port can be susceptible to DDoS amplification attacks and information leakage via enumeration.

Common mitigations:

  • Disable RPC services on machines where they are unnecessary or use host-based firewalls to restrict access to trusted IP ranges.
  • Employ network firewalls to block inbound connections to port 135 from untrusted networks, particularly the internet.
  • Ensure that Windows systems are regularly updated with the latest security patches addressing RPC-related vulnerabilities.
  • Implement network segmentation and use VPNs for remote management to reduce the attack surface exposed on port 135.
  • Enable monitoring and intrusion detection to detect unusual activity involving RPC services.

Related Ports

all 216 in security →

the 8 most looked-up other ports in security — 216 ports carry that label.

portservicerisk
:8881Atlasz Secure Servercaution
:443HTTPScaution
:8291Winbox MikroTik Admincaution
:3268Microsoft Global Catalog (GC)caution
:3128Squid Proxy HTTPcaution
:8080HTTP Alternatecaution
:7000Vuze HTTPS Trackercaution
:981Check Point Embedded HTTPS Managementcaution

risk mix of the 8 listed

  • caution100%

4 of 8 encrypted