2

On Windows8.1, there are many advfirewall rules named ... (RPC-EPMAP) with:

  • same Local port: RPC Endpoint Mapper
  • same Program: svchost.exe
  • same Service: RPCSS

and I didn't find any difference between these rule definitions.

Why are there those similar rules?

Improve this question

1 Answer 1

Reset to default
2

RPC-EPMAP is the RPC "endpoint mapper", which multiplexes several different MSRPC-based services over a single port. (Similar to HTTP vhosts, I guess.)

Windows Firewall knows more than just TCP ports – AFAIK, it can block and allow individual MSRPC services. So my first guess would be that these rules have hidden parameters which select a specific service.

(The other guess is that the rules are duplicates, but needed for Windows Firewall's "simple mode" rule-groups to work.)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .