Created attachment 15463 [details]
Image of connection issue
Bug related to changes in bug 11428  - "dcerpc binding string options are nowhere documented".
The binding strings as documented in the man page for rpcclient do not work.
Namely, I have been attempting to use "ncacn_ip_tcp:x.x.x.x" to connect directly to the MS-RPC service using DCERPC. Instead, rpcclient attempts to connect on port 445 and then on port 139 using SMB. I.e., it behaves if the binding string specified was "ncacn_np:x.x.x.x".
Please see attached image of a Wireshark capture next to the command execution.
I have taken preliminary look over the code of rpcclient.c  and it does appear that both the transport and port from when the binding string is parsed are not passed into cli_full_connection function call. Instead the port can be specified using the command line option '-p'.
Probably the easiest course of action is to clarify in the man page that the transport ncacn_ip_tcp is not supported.