whatportis.com
suggest an edit →

Port 139NetBIOS Session Service

Port 139 is primarily used by the NetBIOS Session Service, enabling communication between devices on a local network using the NetBIOS protocol. It facilitates file and printer sharing over Windows networks by allowing sessions over TCP/IP. Historically integral to Windows networking, it allows systems to identify each other and establish resource-sharing connections..

inFile TransferNetwork ServicesSystem
transport
tcp · udp

2 transports registered

in transit
cleartext

payload readable on path

assignment
official

registered with iana

risk
4/10

caution

lookups
13,276

rank 278 of 993 · top 28%

Technical Details

what runs on :139

Port 139 corresponds to the NetBIOS Session Service, which establishes and maintains sessions for communication over NetBIOS on TCP/IP networks. This port is a vital part of the legacy SMB (Server Message Block) protocol stack, specifically SMB over NetBIOS framing. It allows devices within the same local segment to exchange session-based data, performing operations such as file and printer sharing and inter-process communications.

When a connection is initiated on port 139, the NetBIOS Session Service facilitates session establishment, maintenance, and termination. It transmits session-control packets to manage the communication between hosts. Name resolution and datagram distribution are handled by related NetBIOS services on other ports (like 137 and 138), whereas port 139 focuses solely on session-level data exchange.

Modern implementations have moved towards using port 445 (Direct hosted SMB) that bypasses legacy NetBIOS framing for efficiency and security. Nevertheless, port 139 remains operational in many environments for backward compatibility, especially where mixed or older Windows systems are present.

Security Information

exposure of :139

risk score

4/ 10caution

worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.

file transfer averages 4.1 across 114 ports — this one sits 0.1 below.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

official

registered with iana for this service — scanners fingerprint it by number

reachable over

tcp · udp

udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite

security overview

Common Vulnerabilities:

  • Exposure can lead to information disclosure such as NetBIOS names and shares enumeration.
  • Susceptible to exploitation using tools that gather usernames, machine accounts, and share lists which can aid lateral movement.
  • Historically associated with worms like Conficker and vulnerabilities such as null session attacks that allow unauthenticated resource enumeration.
  • Open to brute force attacks targeting weak SMB credentials.

Mitigations:

  • Disable NetBIOS over TCP/IP where not required to minimize attack surface.
  • Employ firewalls to block external access to port 139 and limit it strictly to trusted internal hosts.
  • Enforce strong authentication policies and disable null sessions through system hardening.
  • Keep systems updated with security patches addressing SMB and NetBIOS vulnerabilities.
  • Consider migration to SMB over port 445 with appropriate hardening and encrypted transport (SMB signing or encryption).

Related Ports

all 114 in file transfer →

the 8 most looked-up other ports in file transfer — 114 ports carry that label.

portservicerisk
:9080Groove RPCcaution
:17500Dropbox LAN Synccaution
:548Apple Filing Protocolcaution
:7000Vuze HTTPS Trackercaution
:1337PowerFolder P2Pcaution
:9001SharePoint Authoringcaution
:8080FilePhile Relaycaution
:1337WASTE Encrypted Sharingcaution

risk mix of the 8 listed

  • caution100%

1 of 8 encrypted