Port reference
Port 137 (UDP) – NetBIOS Name Service
NetBIOS Name Service — legacy Windows name resolution over UDP, widely abused for spoofing.
Quick facts
- Transport
- udp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on older or misconfigured Windows hosts where NetBIOS over TCP/IP is enabled. Often still on by default on workstations.
What is port 137 used for?
Port 137 carries the NetBIOS Name Service (NBT-NS), the legacy Windows way of turning computer and workgroup names into IP addresses on a local network — an older alternative to DNS. Windows machines broadcast on UDP 137 to register their names and find each other. DNS replaced it long ago, but it stays enabled on many workstations and older servers for backward compatibility.
When would you open it?
You'd only allow port 137 on a local network that still relies on legacy NetBIOS name resolution or older Windows file sharing. On modern, DNS-based networks it's better to leave it off entirely; there's no reason to forward it across the internet.
Is it safe to open?
NBT-NS has no authentication and is easily spoofed to steal Windows credentials, so disable it where DNS works and block UDP 137 at network boundaries. See the security notes below.
How to check if this port is open
ss -tulpn | grep :137
nmap -sU -p 137 <target>netstat -ano | findstr :137
Test-NetConnection <host> -Port 137 # TCP onlylsof -i :137
nmap -sU -p 137 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 137 to your device's local IP, internal port 137, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 137/udpsudo firewall-cmd --permanent --add-port=137/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 137 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 137" -Direction Inbound -Protocol UDP -LocalPort 137 -Action AllowSecurity & risks
Common attacks
- Host and share enumeration via nbtstat
- NBT-NS spoofing/poisoning with Responder
- Forced NTLM authentication and relay
- Information disclosure (names, MAC, logged-on user)
Hardening
- Disable NetBIOS over TCP/IP where DNS suffices
- Disable LLMNR and mDNS alongside NBT-NS to stop poisoning
- Enforce SMB signing to break relayed authentication
- Block UDP 137 at network boundaries
- Segment legacy hosts that still require NetBIOS
How to block this port
sudo ufw deny 137/udpsudo firewall-cmd --permanent --remove-port=137/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 137 -j DROPNew-NetFirewallRule -DisplayName "Block 137" -Direction Inbound -Protocol UDP -LocalPort 137 -Action Blocknmap snippet
nmap -sU -p137 --script nbstat <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 137 used for?
- Port 137 is the NetBIOS Name Service, a legacy Windows protocol that resolves NetBIOS names to IP addresses on a local network — a precursor to DNS-based resolution.
- Why is NetBIOS Name Service dangerous?
- When a host can't resolve a name via DNS, it broadcasts an NBT-NS query. Attackers with Responder answer those broadcasts, capturing or relaying NTLM credentials.