Ports

Port 139: NetBIOS Session Service

Legacy Windows session layer for SMB over NetBIOS. Mostly replaced by 445.

Where you will see it: You will see this in scans, firewall rules, vulnerability reports, and service configs. Treat open ports as exposure points and verify the service is expected, hardened, and restricted.

What it is

TCP port 139 is the NetBIOS Session Service, historically used to carry SMB file sharing over NetBIOS on Windows networks. A port is a transport layer number used together with an IP address and a protocol such as TCP or UDP to direct traffic to the correct service on a host. A server process binds a socket to a port and listens, while a client typically chooses an ephemeral source port for outbound connections.

The combination of source and destination IP addresses, source and destination ports, and the transport protocol uniquely identifies a flow so the operating system can keep many conversations separate. Firewalls, NAT, and scanners talk about ports because the destination port is the stable rendezvous point that exposes a service to the network.

In real usage, a client opens a TCP connection to port 139, negotiates a NetBIOS session, and then speaks SMB commands to authenticate, list shares, and read or write files. Modern Windows uses SMB directly over TCP 445 in most environments, but 139 still appears on legacy systems, older device firmware, and misconfigured networks where NetBIOS is enabled.

Because file sharing surfaces are high value, open 139 is commonly associated with credential exposure, share enumeration, and lateral movement once an attacker is inside a network. Understanding the port helps you interpret scans: 139 often means legacy Windows file sharing behavior rather than a modern hardened SMB stack.

How it works in broad strokes

  1. A client establishes a NetBIOS session and then speaks SMB over that session.
  2. Name resolution and discovery are often tied to older NetBIOS mechanisms.
  3. Many environments disable this path and rely on SMB over 445 instead.

Concrete example

A scan finds 139 open on a server. That suggests NetBIOS is enabled and SMB might be reachable via legacy paths, so you review file sharing exposure and tighten firewall rules.

Why it matters

Port 139 matters because it often signals outdated configuration, legacy devices, or relaxed Windows file sharing exposure. In security scanning, 139 and 445 are high signal ports for lateral movement and credential attacks.

Security angle

  • Disable NetBIOS where possible and use modern SMB settings with signing and hardening.
  • Restrict 139 and 445 to trusted segments and monitor authentication attempts.
  • Inventory legacy systems that still require NetBIOS and plan a migration.

Common pitfalls

  • Leaving NetBIOS enabled across subnets when it is not needed.
  • Exposing Windows file sharing to untrusted networks.
  • Assuming blocking 445 is enough. Some systems may still accept SMB over 139.