Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

Ports 137 to 139 (NetBIOS): what they are, how they are attacked and how to secure them

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 9 November 2026.

In one sentence: Ports 137, 138 and 139 belong to NetBIOS, an old Windows way of finding and sharing computers, and they should be blocked at your internet edge.

What runs on these ports

NetBIOS is a naming and sharing layer from the early days of Windows networking. Microsoft lists three ports at the network edge:

Service Protocol Port
NetBIOS Name Resolution UDP 137
NetBIOS Datagram Service UDP 138
NetBIOS Session Service TCP 139

Port 137 is the NetBIOS name resolution service, and port 139 is the session service that carries file and printer sharing (SMB) over NetBIOS. Modern Windows uses port 445 instead. Microsoft notes that the use of NetBIOS for SMB transport ended with SMB 2.02, in Windows Vista and Windows Server 2008, though you may still have software and devices other than Windows that use it. SMB version 1 still uses NetBIOS.

Why attackers look for it

An answer on 137 or 139 from the internet suggests that a Windows or Samba file-sharing service may be reachable. Internet-wide scanners record which addresses answer. Open Windows sharing ports are also the starting point for the file-share attacks described in the SMB entry.

How it gets attacked

  • Exposed legacy SMB. CISA’s SMB advice says legacy versions of SMB could allow a remote attacker to obtain sensitive information from affected systems. It recommends disabling SMBv1 and blocking SMB at the network boundary: TCP 445, UDP 137 and 138, and TCP 139.
  • Spreading inside a network. The CISA #StopRansomware guide says malicious actors use SMB to propagate malware across organisations. That is why it asks for internal SMB to be limited to the systems that need it.
  • Weak or missing signing. The same guide says that requiring SMB signing prevents certain adversary-in-the-middle and pass-the-hash attacks.
  • Old software. NetBIOS often survives because of an old scanner, NAS or line-of-business application that nobody has replaced.

Who it affects and how badly

  • Sole trader to 10 staff. A home-style router with a NAS can leave file sharing open without anyone knowing. Worst case: shared client files are readable or encrypted.
  • 10 to 50 staff (accountancy, legal, construction, estate agents). A single Windows file server is the whole business. Worst case: ransomware that spreads over SMB stops all work and the firm cannot reach client files.
  • 50 to 250 and regulated (care providers, schools, fintech, councils). Old devices on flat networks are common. Worst case: lateral spread, loss of availability, and a personal data breach that must be assessed under UK GDPR, EU GDPR or the Armenian Personal Data Protection Law.

What we check on a test

  • Whether UDP 137, UDP 138 and TCP 139 answer from outside, and whether 445 does.
  • Whether SMBv1 is still switched on, and which hosts negotiate it.
  • Whether SMB signing is required on servers and workstations.
  • Which devices, such as printers and NAS units, still depend on NetBIOS, so a fix does not break the office.
  • Whether workstations can reach each other over SMB when they have no need to.

The UK angle

The NCSC’s Cyber Essentials requirements (version 3.3, April 2026) say the firewall control exists to make sure only secure and necessary network services can be accessed from the internet. They require unauthenticated inbound connections to be blocked by default, and inbound rules to be approved and documented with a business need. They also require unnecessary software and network services to be removed or disabled. NetBIOS on an internet-facing device usually meets none of those tests.

Diagram: where to block

Internet Firewall UDP 137, 138, TCP 139, 445 BLOCK Office network SMB only where it is needed

Worked example (illustration only)

A 25-person accountancy has one Windows server and a ten-year-old scanner that saves to a share. Years ago someone forwarded port 139 on the office router so a partner could reach files from home. It was never removed. Nobody notices until an audit asks why file sharing faces the internet. The cost is a stressful week: removing the rule, moving remote access to a VPN or a cloud file service, and replacing the scanner setting. The fix is cheap if it is done before something goes wrong.

How to check whether yours is exposed

  1. Review your router and firewall port-forward and inbound rules for UDP 137, UDP 138, TCP 139 and TCP 445.
  2. List which devices on your own network still use SMBv1 or NetBIOS (scanners, NAS units, old servers).
  3. Run the free scan against your own public address.
  4. Only test addresses you own or have written permission to test.

How to secure it

  1. Block TCP 445 inbound and outbound at the internet firewall, and block 137, 138 and 139 too. This is CISA’s and Microsoft’s advice for the network edge.
  2. Disable SMBv1 and move to SMBv3, after you have found anything that depends on the old version. CISA’s guide recommends SMB 3.1.1 where possible.
  3. Limit internal SMB so only systems that need it can talk. Most workstations do not need to reach other workstations.
  4. Require SMB signing, or SMB encryption where supported.
  5. Do not trust the default firewall state. Microsoft says to verify and actively manage settings through Group Policy or another management tool.
  6. For remote access, use a VPN or a cloud file service, not an open port.
  7. Log and monitor SMB traffic so odd behaviour is seen.

FAQ

Is port 139 the same as port 445? No. Port 139 carries SMB over NetBIOS. Port 445 carries SMB directly. Both belong at the edge firewall as blocked.

Will blocking NetBIOS break my office? It can, if an old device needs it. CISA cautions that blocking SMB may obstruct access to shared files, so check first.

Does modern Windows need ports 137 to 139? Microsoft says NetBIOS transport for SMB ended with SMB 2.02. Older devices may still rely on it.

Related terms

port-445-smb, smb-signing, port-135-msrpc, netbios-and-llmnr-name-resolution, cyber-essentials, patch-management

More in the ports and protocols hub.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. See our penetration testing service and start with the free web vulnerability scan.