Solved

rpc port 49158

Posted on 2010-09-07
1
4,803 Views
Last Modified: 2013-12-04
I am trying to do a small test for restricting rpc to use static port. Using the Registry I did static port assignment for NTDS to be 49155 in the domain controller. I have two virtual machines, the dc is running windows 2008 r2 with ip 10.2.2.2, and a member server running windows 2003 ip 10.8.8.8. using the dc windows firewall i created new rpc rule to use port 49155. from the firewall log bellow I have two questions:
1- why win2003 is trying to connect to 10.2.2.2 with port 49158? And what is the affect of that?
2- for NTDS static port assignment , do I have to do it for all the company dc’s?
 Thanx
firewall log
ALLOW UDP 10.8.8.8 10.2.2.2 1026 53 0 -- RECEIVE
ALLOW TCP 10.8.8.8 10.2.2.2 1058 135 0 - 0 0 0 - - - RECEIVE
DROP TCP 10.8.8.8 10.2.2.2 1059 49158 48 S 1388427278 0 64240 - - - RECEIVE
DROP TCP 10.8.8.8 10.2.2.2 1059 49158 48 S 1388427278 0 64240 - - - RECEIVE
ALLOW UDP 10.8.8.8 10.255.255.255 138 138 0 -- RECEIVE
ALLOW UDP 10.8.8.8 10.2.2.2 1060 88 0 -- RECEIVE
ALLOW TCP 10.8.8.8 10.2.2.2 1061 88 0 - 0 0 0 - - - RECEIVE
ALLOW UDP 10.8.8.8 10.2.2.2 1062 88 0 -- RECEIVE
DROP TCP 10.8.8.8 10.2.2.2 1059 49158 48 S 1388427278  - - RECEIVE
DROP UDP 10.8.8.8 10.255.255.255 137 137 78 -- RECEIVE
DROP UDP 10.8.8.8 10.255.255.255 137 137 78 -- RECEIVE
DROP UDP 10.8.8.8 10.255.255.255 137 137 78 -- RECEIVE
ALLOW ICMP 10.8.8.8 10.2.2.2 - - 0 - - - - 8 0 - RECEIVE
DROP UDP 10.8.8.8 10.2.2.2 137 137 78 -- RECEIVE
DROP UDP 10.8.8.8 10.2.2.2 137 137 78 -- RECEIVE
DROP UDP 10.8.8.8 10.2.2.2 137 137 78 -- RECEIVE
DROP UDP 10.8.8.8 10.255.255.255 137 137 78 -- RECEIVE
DROP UDP 10.8.8.8 10.255.255.255 137 137 78 -- RECEIVE
DROP UDP 10.8.8.8 10.255.255.255 137 137 78 -- RECEIVE
ALLOW TCP 10.8.8.8 10.2.2.2 1064 49155 0 - 0 0 0 - - - RECEIVE
0
Comment
Question by:alex-2010
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 41

Accepted Solution

by:
Adam Brown earned 500 total points
ID: 33666695
The RPC ports that you're messing with are actually client ports. When a DC makes an RPC request to another DC for replication, it will initiate the request on one of the ports in the range so the RPC server is able to more easily route traffic back to the requesting client. That port is chosen randomly from a range of several thousand. Pinching down the RPC ports on the server will limit the ports that it uses to make requests. So in your situation, the Win2k3 server is opening an RPC request on port 49158 which is being blocked by your firewall. In order to limit ports used by RPC, you'll need to actually limit the ports available on all DCs.

Also, I wouldn't recommend using a single port for RPC client requests, as you may rapidly run out of available ports and in turn decrease throughput and increase latency for replication.
0

Featured Post

Is your NGFW recommended by NSS Labs?

Ours is! NSS Labs Next Generation Firewall Test gives the WatchGuard Firebox M4600 a "Recommended" rating! Curious where your NGFW landed on the  Security Value Map? See the map and download the full report today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Article by: btan
The intent is not to repeat what many has know about Ransomware but more to join its dots of what is it, who are the victims, why it exists, when and how we respond on infection. Lastly, sum up in a glance to share such information with more to help…
Recently, I read that Microsoft has analysed statistics for their security intelligence report. It revealed: still, the clear majority of windows users do their daily work as administrator. An administrative account is a burden, security-wise. My ar…
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…

691 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question