Port 135: MS RPC
TCP 135 is the port for Microsoft RPC endpoint mapper (DCOM). Never on the internet. Historically exploited by worms such as Blaster.
| Service | Microsoft RPC endpoint mapper (DCOM) |
|---|---|
| Protocol | TCP |
| Exposure risk | High: do not expose to the internet |
| Range | Well-known (0–1023): binding needs root/admin on Unix |
What port 135 does
Windows uses the RPC endpoint mapper on 135 to tell clients which dynamic high port a service such as WMI, DCOM or Active Directory replication is listening on.
Should port 135 be open?
Never on the internet. Historically exploited by worms such as Blaster.
Find what's listening on port 135
- Linux:
sudo ss -tulpn | grep :135 - macOS:
sudo lsof -nP -i :135 - Windows:
netstat -ano | findstr :135, then look up the PID in Task Manager.
Open or block it in a firewall
- ufw:
sudo ufw allow 135/tcp(ordeny) - firewalld:
sudo firewall-cmd --add-port=135/tcp --permanent && sudo firewall-cmd --reload - Windows:
New-NetFirewallRule -DisplayName "Port 135" -Direction Inbound -Protocol TCP -LocalPort 135 -Action Allow
Port assignment per the IANA Service Name and Transport Protocol Port Number Registry. Test several ports at once with the port scanner, or any port with the open port checker.
Questions about port 135
What is port 135 used for?
Microsoft RPC endpoint mapper (DCOM). Windows uses the RPC endpoint mapper on 135 to tell clients which dynamic high port a service such as WMI, DCOM or Active Directory replication is listening on.
Is port 135 TCP or UDP?
TCP. MS RPC uses TCP port 135.
Is it safe to open port 135?
High: do not expose to the internet. Never on the internet. Historically exploited by worms such as Blaster.
How do I check if port 135 is open?
Use the checker on this page: it connects to your host on TCP 135 from the internet. Locally, run
nc -vz host 135 (macOS/Linux) or Test-NetConnection host -Port 135 (PowerShell). To see what is listening on your own machine, run ss -tulpn | grep :135 (Linux) or netstat -ano | findstr :135 (Windows).