2

On Windows8.1, there are many advfirewall rules named ... (RPC-EPMAP) with:

  • same Local port: RPC Endpoint Mapper
  • same Program: svchost.exe
  • same Service: RPCSS

and I didn't find any difference between these rule definitions.

Why are there those similar rules?

unarist
  • 123

1 Answers1

2

RPC-EPMAP is the RPC "endpoint mapper", which multiplexes several different MSRPC-based services over a single port. (Similar to HTTP vhosts, I guess.)

Windows Firewall knows more than just TCP ports – AFAIK, it can block and allow individual MSRPC services. So my first guess would be that these rules have hidden parameters which select a specific service.

(The other guess is that the rules are duplicates, but needed for Windows Firewall's "simple mode" rule-groups to work.)

u1686_grawity
  • 452,512