Any one for MS/DCE:RPC port?

[ciscomeo]

Should I add this in my protocol database? I notice that its source port no. always change. What application uses this port and how does it function?

 

[rwullems]

On your question if it is using different port, YES, in a microsoft envimroent, DCE is a wide range of services/protcols
From the NAI TNV-323 course (not to much,in case of copyrights):
****************************************************

TCP/135: the Locator Service
A well-known port, listed in RFC 1700 as the Locator Service
Endpoint Mapper and the RPC Bind preceding it

TCP/1026 (or other high-order port): Ports are not Well-known, but frequently used by RPCs and other DCE services
NetRlogon
Alter Context
Server Service
Others
By using regedit, one may assign the port by editing the TCP/IP port value to the desired value

TCP/139: MSRAP
Runs over NetBIOS/SMB

******************************************************
Can you assign a fixed port if absolutly neccesary? Yes, again.
From the NAI TNV-323 course (not to much,in case of copyrights):

******************************************************
To assign a fixed port for RPCs:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
Add a new DWORD value called TCP/IP Port (include the space).
Set the value's data to the port number that you want to use—remember to change the displayed base to decimal before you enter the data. Do this on all your Active Directory servers. You must restart them for the change to take effect.
******************************************************

The chapter about DCE/RPC gives much more information, to much to publsh here.

A lot of information can be found on technet, using the search frase endpoint mapper, DCE of RPC.

Regards,
Robert