Port reference
Port 139 (TCP) – NetBIOS Session Service
NetBIOS Session Service — legacy transport for SMB file and printer sharing over NetBIOS.
Quick facts
- Transport
- tcp
- Category
- Well-known
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on Windows hosts with NetBIOS over TCP/IP enabled. Largely superseded by direct SMB on 445 but still present on legacy systems.
What is port 139 used for?
Port 139 is the NetBIOS Session Service, the legacy way Windows carried SMB file and printer sharing over NetBIOS. Before Windows 2000 introduced direct SMB on port 445, all Windows file sharing ran here. It still appears on hosts that have NetBIOS over TCP/IP enabled and usually goes hand in hand with the NetBIOS Name Service on UDP 137.
When would you open it?
You'd only allow port 139 on a local network with older Windows or Samba systems that share files the legacy way. Modern setups use SMB on port 445 instead, so on current networks 139 can usually stay closed, and it should never be exposed to the internet.
Is it safe to open?
It carries the same file-sharing risks as port 445 plus old, weak defaults like SMBv1 (the EternalBlue/WannaCry vector), so disable SMBv1, prefer port 445 with signing, and block 139 at network boundaries. See the security notes below.
How to check if this port is open
ss -tulpn | grep :139
nmap -p 139 <target>netstat -ano | findstr :139
Test-NetConnection <host> -Port 139lsof -i :139
nmap -p 139 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 139 to your device's local IP, internal port 139, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 139/tcpsudo firewall-cmd --permanent --add-port=139/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 139 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 139" -Direction Inbound -Protocol TCP -LocalPort 139 -Action AllowSecurity & risks
Common attacks
- Null-session enumeration of users, shares, and policies
- SMB relay and credential capture
- EternalBlue / MS17-010 exploitation against SMBv1
- Ransomware lateral movement over file shares
Hardening
- Disable SMBv1 entirely
- Disable NetBIOS over TCP/IP and prefer SMB on 445 with signing
- Block null sessions (restrict anonymous access)
- Enforce SMB signing to defeat relay
- Block TCP 139 at the network boundary
How to block this port
sudo ufw deny 139/tcpsudo firewall-cmd --permanent --remove-port=139/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 139 -j DROPNew-NetFirewallRule -DisplayName "Block 139" -Direction Inbound -Protocol TCP -LocalPort 139 -Action Blocknmap snippet
nmap -p139 --script smb-os-discovery,smb-enum-shares <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between port 139 and 445?
- Port 139 runs SMB over the legacy NetBIOS Session Service, while 445 runs SMB directly over TCP. Modern Windows prefers 445; 139 persists for backward compatibility.
- Is port 139 a security risk?
- Yes. It enables legacy SMBv1, null-session enumeration, and credential relay, and was a vector for EternalBlue-based worms like WannaCry.