whatportis.com
suggest an edit →

Port 138NetBIOS Datagram Service

NetBIOS Datagram Service (port 138) facilitates connectionless communication primarily for NetBIOS over TCP/IP networks. It is used extensively in Windows network environments for tasks such as name service browsing and datagram distribution, aiding functions like resource sharing and messaging within local networks..

inFile TransferNetwork ServicesSystem
transport
tcp · udp

2 transports registered

in transit
cleartext

payload readable on path

assignment
official

registered with iana

risk
4/10

caution

lookups
12,248

rank 320 of 993 · top 32%

Technical Details

what runs on :138

NetBIOS Datagram Service operating over port 138 is a core component of the NetBIOS over TCP/IP suite (NBT). It supports connectionless communication, enabling broadcast and multicast datagrams for providing name resolution, host announcements, and browsing services on local subnets. This allows Windows systems to discover each other, share resources, and broadcast status updates without an established session.

Technically, the Datagram Service complements the other NetBIOS services like the Name Service (port 137) and Session Service (port 139). It relies primarily on UDP, though some implementations may respond over TCP for compatibility. Datagram packets are used to transmit small messages across the local network, such as browsing announcements, mailslots messaging, and system notifications, contributing to NetBIOS name resolution and distributed network management.

Because communication is connectionless, delivery is not guaranteed, making it suitable for scenarios where best-effort delivery suffices. This behavior reduces overhead but may increase network noise due to frequent broadcasts. Consequently, NetBIOS Datagram Service is typically confined to internal scopes like LANs, with modern networks often limiting or replacing it with DNS and newer protocols.

Security Information

exposure of :138

risk score

4/ 10caution

worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.

file transfer averages 4.1 across 114 ports — this one sits 0.1 below.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

official

registered with iana for this service — scanners fingerprint it by number

reachable over

tcp · udp

udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite

security overview

NetBIOS Datagram Service on port 138 has numerous associated vulnerabilities, primarily due to its broadcast nature and legacy design.

Common Vulnerabilities:

  • Information Disclosure: Attackers can enumerate network shares, user names, and system details through NetBIOS datagrams.
  • Denial-of-Service (DoS): Malicious broadcasts or crafted datagrams can flood the network, causing resource exhaustion.
  • Spoofing and Man-in-the-Middle: Lack of encryption and authentication permits spoofing of NetBIOS packets, enabling session hijacking or traffic interception.
  • Relay Attacks: Combining NetBIOS weaknesses with other protocols can facilitate relay attacks for privilege escalation.

Common Mitigations:

  • Disable NetBIOS: Where possible, disable NetBIOS over TCP/IP on modern Windows systems.
  • Network Segmentation: Limit NetBIOS traffic to trusted internal segments using VLANs and firewalls.
  • Firewall Filtering: Block inbound and outbound NetBIOS ports (137-139) at perimeter to prevent exploitation from external sources.
  • Use Stronger Protocols: Replace legacy NetBIOS services with SMB over TCP/445, DNS, or modern directory services.
  • Monitoring: Continuously monitor for suspicious NetBIOS traffic and unusual datagram broadcasts to detect attacks early.

Related Ports

all 114 in file transfer →

the 8 most looked-up other ports in file transfer — 114 ports carry that label.

portservicerisk
:9080Groove RPCcaution
:17500Dropbox LAN Synccaution
:548Apple Filing Protocolcaution
:7000Vuze HTTPS Trackercaution
:1337PowerFolder P2Pcaution
:9001SharePoint Authoringcaution
:8080FilePhile Relaycaution
:1337WASTE Encrypted Sharingcaution

risk mix of the 8 listed

  • caution100%

1 of 8 encrypted