On Windows8.1, there are many advfirewall rules named ... (RPC-EPMAP) with:
- same Local port: RPC Endpoint Mapper
- same Program: svchost.exe
- same Service: RPCSS
and I didn't find any difference between these rule definitions.
Why are there those similar rules?
1 Answer
RPC-EPMAP is the RPC "endpoint mapper", which multiplexes several different MSRPC-based services over a single port. (Similar to HTTP vhosts, I guess.)
Windows Firewall knows more than just TCP ports – AFAIK, it can block and allow individual MSRPC services. So my first guess would be that these rules have hidden parameters which select a specific service.
(The other guess is that the rules are duplicates, but needed for Windows Firewall's "simple mode" rule-groups to work.)
