exchange 2019 - port 6400

Question

we are running exchange server 2019 cu12 and the latest patch released this month.

A few days after doing that patch install, our security team reported that the server is now connecting out via port 6400. Looking on the web there isnt very many reports of this port. Any ideas if the most recent patch caused this?

Answer 1

Hi @NP,

A few days after doing that patch install, our security team reported that the server is now connecting out via port 6400.

As far as I know, it's an expected behavior that port 6400 might be used for outgoing connections every time Outlook clients establish a connection to Exchange.

According to the official article below (The article is for Exchange 2010, but basically, it's the same case in Exchange 2019), "By default, the RPC Client Access service on an Exchange 2010 Client Access server uses the TCP End Point Mapper port (TCP/135) and the dynamic RPC port range (6005-59530) for outgoing connections, every time Outlook clients establish a connection to Exchange."
Exchange 2010 Client Access Server: Configure Static RPC Ports

So, based on my understanding, although port 6400 is not a specifically used port by Exchange, any random port could be used in port range (6005-59530) for outgoing connections every time an Outlook client establish a connection.

Also found the post below which mentions about port 6400, but from the discussion there, it didn't cause any problems.
Exchange Server listening on port 6400
(Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.)

Therefore, I assume you can just rest assured about it.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

@Yuki Sun-MSFT thanks for the response. I guess the main concern was that this seems to be something that has happened out of the blue and strangley soon after the most recent security update. I will advise our security team of the article you posted