PORTLegacyUnencryptedIANA assigned
Ports 137, 138 and 139NetBIOS over TCP/IP
Ports 137, 138 and 139 carry NetBIOS over TCP/IP (NBT): UDP 137 for name resolution, UDP 138 for datagrams and browsing, and TCP 139 for SMB sessions over NetBIOS. Modern Windows uses port 445 for SMB and DNS for names, so these ports are legacy; they are still enabled by default and can usually be turned off.
What ports 137–139 are used for
Before DNS and direct-hosted SMB, Windows networking ran on NetBIOS, a 1980s API for naming and messaging on a LAN. NetBIOS over TCP/IP (NBT) maps that API onto three ports:
| Port | Name | Purpose |
|---|---|---|
| UDP 137 | Name service | Resolve 15-character computer names by broadcast or via a WINS server |
| UDP 138 | Datagram service | Browser announcements ("Network Neighborhood"), Messenger-style datagrams |
| TCP 139 | Session service | SMB file sharing carried inside NetBIOS sessions |
Windows 2000 introduced SMB directly over TCP on port 445, and DNS replaced NetBIOS names in Active Directory. Modern clients try 445 first and fall back to 139 only if it fails.
Why they are still on
Windows enables NBT by default for compatibility. On a home LAN, UDP 137 name resolution still helps find devices by name when DNS is absent. In a domain it is essentially unused.
Security considerations
- Name spoofing. Any device on the LAN can answer a UDP 137 name query, so an attacker can impersonate a server and capture authentication attempts when a mistyped name falls back to NetBIOS. Disabling NBT (and LLMNR) on managed workstations removes the vector.
- Information disclosure.
nbtstat -aagainst a host reveals its name, workgroup and logged-on user. - Internet exposure. Nothing on 137–139 should be reachable from outside; block them at the edge alongside 445.
Checking on Windows
nbtstat -n
netstat -ano | findstr ":139 :137 :138"ipconfig /all shows "NetBIOS over Tcpip" status per adapter.
Firewall considerations
The File and Printer Sharing rule group covers 137–139 alongside 445. Disable the group on the Public profile (the default) and consider disabling NBT per adapter in managed environments.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 139 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
Can I disable NetBIOS over TCP/IP?
Yes, per adapter: network adapter properties → IPv4 → Advanced → WINS → "Disable NetBIOS over TCP/IP", or via DHCP option. Modern domains and file sharing work without it. Test first if you still have very old devices or applications that address machines by 15-character NetBIOS names.
What is nbtstat?
A Windows command that shows the NetBIOS name table and cache (nbtstat -n, nbtstat -c) and resolves names over UDP 137 (nbtstat -a hostname).