Common attacks and weaknesses
- Same exposure as SMB 445 (null sessions, relay, old SMB vulnerabilities).
- Host and user enumeration.
Port 139: NetBIOS Session
SMB over NetBIOS, the legacy transport for Windows file sharing.
139
How NetBIOS Session works
File transfer & sharingFiles are sent over port 139 in pieces and reassembled on the other side. It travels in clear text: anyone on the path can read it, passwords included.
- Transport
- TCP · UDP
- Exposure risk
- 8/10 high if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
- File transfer & sharing
Is port 139 dangerous?
How to secure it
- Block at the edge.
- Disable NetBIOS over TCP/IP where it is not needed.
IANA registry entries for port 139
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| netbios-ssn | 139 | TCP, UDP | NETBIOS Session Service | - | - |
// source: IANA service name and port number registry
Which program uses port 139, and is it reachable?
Linux
sudo ss -ltnup 'sport = :139' # process listening on 139
sudo lsof -nP -i :139macOS
sudo lsof -nP -i :139
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 139 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 139 netstat -ano | findstr :139
From another machine
nmap -p 139 -sV <host> sudo nmap -sU -p 139 <host> nc -zv <host> 139
Block it in the firewall
sudo ufw deny 139/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 139" -Direction Inbound -LocalPort 139 -Protocol TCP -Action Block # Windows
What is port 139 used for?
SMB over NetBIOS, the legacy transport for Windows file sharing.
Is port 139 TCP or UDP?
Port 139 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 139?
It is rated 8/10 (high) when exposed to the Internet. Same exposure as SMB 445 (null sessions, relay, old SMB vulnerabilities). Block at the edge.
How do I check if port 139 is open?
On Linux run "ss -ltnup 'sport = :139'", on macOS "lsof -nP -i :139", and on Windows "netstat -ano | findstr :139" to see the local process. From another machine, "nmap -p 139 <host>" shows whether it is reachable.
Other file transfer & sharing ports
:445 SMB tcp · udp · critical risk :21 FTP tcp · udp · sctp · high risk :69 TFTP udp · tcp · high risk :2049 NFS tcp · udp · sctp · high risk :873 rsync tcp · udp · high risk :20 File Transfer [Default Data] tcp · udp · sctp :115 Simple File Transfer Protocol tcp · udp :152 Background File Transfer Program tcp · udp