TCP Port 137 – NetBIOS Name Service (NetBIOS-NS)
Port 137 is the standard port for the NetBIOS Name Service, the component of the legacy NetBIOS protocol suite responsible for name resolution on local Windows networks. NetBIOS Name Service does for Windows machine names roughly what DNS does for internet domain names: it lets a computer ask “what is the IP address of the machine called BACKUPSERVER?” and get an answer back. The service uses port 137 on both UDP (for the broadcast queries that find machines on the local network segment) and TCP (used in some name registration scenarios).
NetBIOS dates to the early 1980s, when it was developed for IBM PC networks. Microsoft adopted it for Windows networking and layered SMB file sharing on top of it; the combination was the foundation of Windows networking through the 1990s. Port 137 worked alongside port 138 (NetBIOS Datagram Service) and port 139 (NetBIOS Session Service) to provide the full set of name resolution, broadcast, and connection-oriented capabilities that Windows networks needed.
Modern Windows networks use DNS for name resolution and SMB directly on port 445 for file sharing, displacing the original three-port NetBIOS arrangement. Port 137 still appears in real networks because Windows continues to support NetBIOS for backward compatibility and because some older devices, applications, and protocols still depend on it. Disabling NetBIOS over TCP/IP entirely is now common practice in security-conscious environments.
Inbound port 137 traffic from the public internet is unusual in 2026 and is widely treated as either a misconfiguration or an enumeration attempt. Outbound port 137 from end-user devices is normal within a Windows-based local network and uncommon to internet destinations.
About TCP Port 137
Port 137 carries the IANA assignment for netbios-ns. The IANA description reads: ‘NETBIOS Name Service’.
Security Considerations
NetBIOS Name Service on port 137 has a long history of network reconnaissance and disclosure issues. Because the service is designed to answer questions about Windows machines by name, an attacker who can reach port 137 on a target can often enumerate machine names, NetBIOS workgroup or domain names, logged-in users, and shared resources. This kind of information was the first step in many late-1990s and early-2000s Windows intrusions and remains a useful reconnaissance tool against networks that still expose NetBIOS.
Our data shows 10 IDS rules referencing port 137, dominated by attempted-admin and reconnaissance classtypes. Sample rules detect the Winnuke attack (a 1997 out-of-band packet exploit that crashed early Windows machines, with related signatures appearing on this port and on port 139), generic NetBIOS name service overflow attempts targeting Windows name handling code, and modern security-tool scanning patterns including Nessus NetBIOS enumeration. The Sourtoff malware family also appears in the dataset, primarily as a download-related signature rather than a port-137-specific behavior.
Because exposing NetBIOS to the public internet has been recognized as a serious risk for over two decades, most ISPs filter port 137 at their network edges, most home routers block inbound 137 by default, and most modern Windows configurations either disable NetBIOS over TCP/IP entirely or restrict it to internal interfaces. The attack surface that mattered most is largely closed off in 2026, but legacy environments and misconfigured edge devices still occasionally expose it.
Inbound TCP/UDP 137 from the public internet is unusual and is generally a sign of either a misconfigured legacy device or an active scan. Common practice in modern Windows environments is to disable NetBIOS over TCP/IP entirely on internet-facing interfaces.
IDS Rule References
4 IDS / security rules reference TCP port 137. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 4): misc-activity (1), trojan-activity (1), attempted-dos (1), attempted-admin (1).
Sample rule descriptions for TCP port 137:
- SERVER-OTHER Winnuke attack
- OS-WINDOWS name query overflow attempt TCP
- ET SCAN Behavioral Unusual Port 137 traffic Potential Scan or Infection
- ET MALWARE Sourtoff Download Simda Request
Malware Activity
Some malware indicators are observed on this port.
1 of 4 IDS rules for TCP port 137 involve malware activity.
Families observed (top 1): Sourtoff (1).
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).