Description:

A very brief summary of how the protocol works: There is an “endpoint mapper” that runs on TCP port 135.
You can bind to that port on a remote computer anonymously and enumerate all the various RPC services
available on that computer.  The services may be using named pipes or TCP/IP.  Named pipes will use port 445.
The services that are using TCP are each dynamically allocated their own TCP ports,
which are drawn from a pool of port numbers. This pool of port numbers is by default 1024-5000 on XP/2003
and below, and 49152-65535 on Vista/2008 and above. (The ephemeral port range.)

You can customize that port range that RPC will use if you wish, like so:

reg add HKLM\SOFTWARE\Microsoft\Rpc\Internet /v Ports /t REG_MULTI_SZ /f /d 5200-10200
reg add HKLM\SOFTWARE\Microsoft\Rpc\Internet /v PortsInternetAvailable /t REG_SZ /f /d Y
reg add HKLM\SOFTWARE\Microsoft\Rpc\Internet /v UseInternetPorts /t REG_SZ /f /d Y

And/Or
netsh int ipv4 set dynamicport tcp start=5200 num=10200
netsh int ipv4 set dynamicport udp start=5200 num=10200
netsh int ipv6 set dynamicport tcp start=5200 num=10200
netsh int ipv6 set dynamicport udp start=5200 num=10200

I found this very interesting article about how to troubleshoot RPC communications:

http://blogs.technet.com/b/askds/archive/2012/01/24/rpc-over-it-pro.aspx

http://social.technet.microsoft.com/wiki/contents/articles/4494.aspx

http://technet.microsoft.com/en-us/magazine/2007.07.howitworks.aspx

Tools:

rpcdump (from old windows service pack)

test-server  ; powershell script here: https://gallery.technet.microsoft.com/scriptcenter/Powershell-Test-Server-e0cdea9a

test-rpc       ; powershell script here:

rpc-ping     ; powershell script here: http://www.zerrouki.com/rpc-ping/

portqry -n computer -e 135

netmon 3.4

rpcping

rpings