Rpcdump.exe: RPC Dump

This command-line tool queries Remote Procedure Call (RPC) endpoints for status and other information on RPC.

RPC Dump interrogates the endpoint mapper database to obtain a list of every registered endpoint. If the /i switch is specified, the tool pings each endpoint to determine if the service that registered the endpoint is listening. After gathering some other statistics, RPC Dump sorts them and outputs the data.

This tool can help to isolate network troubles involving an RPC.

File Required

• Rpcdump.exe

RPC Dump Topics

• RPC Dump Syntax
• RPC Dump Examples

top

RPC Dump Syntax

rpcdump [/s] [/v] [/i] [/p protocol] [-?]

Where:

/s

specifies the name of the server to interrogate. Defaults to local if not specified.

/v

runs in verbose mode.

/i

pings all registered endpoints to determine if the service that registered the endpoint is listening.

Note

• This can take a while over slow network links. RPC Dump is multithreaded to help performance in this area. A status bar displays the progress.

/p protocol

is the name for one of the supported transport mechanisms of RPC. The default is ncacn_ip_tcp. Valid protocols include the following:

Protocol	Description
ncacn_np	Connection-oriented named pipes
ncacn_mq	Datagram connectionless over the Message Queuing server
ncadg_ipx	Datagram connectionless IPX
ncacn_spx	Connection-oriented SPX
ncacn_http	Connection-oriented TCP/IP using Microsoft Internet Information Services as HTTP proxy.
ncacn_nb_nb	Connection-oriented NetBEUI
ncacn_nb_tcp	Connection-oriented NetBIOS over TCP
ncacn_nb_ipx	Connection-oriented NetBIOS over IPX
ncacn_ip_tcp	Connection-oriented TCP/IP
ncacn_at_dsp	AppleTalk DSP
ncadg_ip_udp	Datagram connectionless UDP/IP
ncacn_vns_spp	Connection-oriented Vines SPP transport
ncacn_dnet_nsp	Connection-oriented DECnet transport
ncacn_nb_xns	Connection-oriented XNS

-?

displays a command-line syntax screen.

top

RPC Dump Examples

Example 1

In this example, a client is unable to start mail because it cannot connect to the server. You can run RPC Dump on the Microsoft Exchange server to verify that the proper services (such as directory and store) are registered and responding to RPC calls.

In the sample output, the Exchange server has registered its endpoints and is listening for RPC calls.

rpcdump /s reskit /i

ncacn_ip_tcp(Connection-oriented TCP/IP)
  172.30.5.86[1526] [f5cc59b4-4264-101a-8c59-08002b2f8426] MS Exchange Directory DRS Interface :YES
  172.30.5.86[1526] [f5cc5a7c-4264-101a-8c59-08002b2f8426] MS Exchange Directory XDS Interface :YES
  172.30.5.86[1526] [f5cc5a18-4264-101a-8c59-08002b2f8426] MS Exchange Directory NSP Interface :YES
  172.30.5.86[1544] [a4f1db00-ca47-1067-b31f-00dd010662da] Exchange Server STORE EMSMDB Interface :YES
  172.30.5.86[1544] [a4f1db00-ca47-1067-b31e-00dd010662da] Exchange Server STORE ADMIN Interface :YES
  172.30.5.86[1544] [89742ace-a9ed-11cf-9c0c-08002be7ae86] Exchange Server STORE ADMIN Interface :YES
  172.30.5.86[1544] [99e64010-b032-11d0-97a4-00c04fd6551d] Exchange Server STORE ADMIN Interface :YES

Notice that some endpoints might not have a friendly name or annotation. The service that registers the endpoint fills in this field.

Example 2

In verbose mode, additional information is displayed, such as version and ComTimeOutValue.

rpcdump /s reskit /i /v

ProtSeq:ncacn_np
Endpoint:\pipe\0000011C.001
NetOpt:
Annotation:Exchange Server STORE ADMIN Interface
IsListening:YES
StringBinding:ncacn_np:\\\\RESKIT[\\pipe\\0000011C.001]
UUID:a4f1db00-ca47-1067-b31e-00dd010662da
ComTimeOutValue:RPC_C_BINDING_DEFAULT_TIMEOUT
VersMajor 1  VersMinor 0