Which TCP ports to use

I would answer that;

For a program you wrote with the winsock API, it handle it kinda that way; http://support.microsoft.com/kb/173619.

When you close the handle to a socket, some additional negotiation goes on between the client and the server. The socket will wait for up to two times the maximum time that windows would wait to receive an acknowledgement from the other end of the socket that closed the port. By default, this option is set to two minutes. Therefore, Windows may wait up to four minutes before the port is actually released. This makes that specific port unavailable until it is actually released.

For Windows RPC service;

*This article does not specify which services rely on other services for network communication. For example, many services rely on the remote procedure call (RPC) or DCOM features in Microsoft Windows to assign them dynamic TCP ports. The Remote Procedure Call service coordinates requests by other system services that use RPC or DCOM to communicate with client computers. Many other services rely on network basic input/output system (NetBIOS) or SMBs, protocols that are provided by the Server service. Other services rely on HTTP or on Hypertext Transfer Protocol Secure (HTTPS). These protocols are provided by Internet Information Services (IIS). A full discussion of the architecture of the Windows operating systems is beyond the scope of this article. However, detailed documentation on this subject is available on Microsoft TechNet and on the Microsoft Developer Network (MSDN) websites. Although many services may rely on a particular TCP or UDP port, only one service or process at a time can listen on that port.

When you use RPC with TCP/IP or with UDP/IP as the transport, incoming ports are frequently dynamically assigned to system services as required; TCP/IP and UDP/IP ports that are higher than port 1024 are used. These are also informally known as random RPC ports. In these cases, RPC clients rely on the RPC endpoint mapper to tell them which dynamic port or ports were assigned to the server. For some RPC-based services, you can configure a specific port instead of letting RPC dynamically assign a port. You can also restrict the range of ports that RPC dynamically assigns to a small range, regardless of the service. For more information about this topic, see the "References" section.*

From: http://support.microsoft.com/kb/832017

TCPView is a very useful tool. After downloading and running, I could see a process using a high ephemeral port number. After a few seconds, the line for that process turned red, then green (I am guessing this indicates the opening of a new port), and then the port number had increased slightly.

Ending this process, unbound all of the ports it had in use, and stopped the exhaustion from happening.