Remote Procedure Call (RPC) and TCP

[Mike Keenan]

Can someone describe from a network point of view what RPC (SUN and/or DCE) is and why it deviates from standard TCP behavior? The way that I understand it is a client reaches out to a server with a unique source port and then switches the source port after the TCP three way handshake finishes. I work with ASA firewalls so this behavior becomes very apparent when the inspection of DCE RPC is not enabled since the firewall will block it because it sees it as a threat. I have read a few MS TechNet articles and other website definitions to include watching about five Youtube videos which all seem to explain it from a programmers perspective but I have yet to fully understand this concept since I am not a programmer.

[Philip D'Ath]

I'm pretty grey on this one.

I think RPC more typically runs over UDP, although it can use TCP.

One connection is opened (if TCP) to send the data to the server where the procedure is executed.  Then another connection is opened back to the client to send the results back.

So the source ports used to send the request might not be the port used to receive the reply.  Just think of it as two separate but related connections.