TCP Port 139 – NetBIOS Session Service (SMB over NetBIOS)

Port 139 is the standard port for the NetBIOS Session Service, the connection-oriented half of the original NetBIOS networking stack on which Windows file sharing was built. Where port 137 handled name resolution and port 138 handled connectionless broadcast traffic, port 139 carried the actual file-sharing sessions. When a Windows client opened a file on a remote server, browsed a network share, or printed to a shared printer, the underlying TCP connection ran through port 139 in this older arrangement.

SMB (Server Message Block) is the protocol that actually carries the file-sharing operations; NetBIOS Session Service was the transport mechanism that SMB rode on top of. Starting with Windows 2000, Microsoft introduced direct SMB over TCP on port 445, which carries the same SMB protocol without the NetBIOS layer underneath. Port 445 became the primary SMB transport over the next several years, but port 139 has remained available on Windows systems for backward compatibility with older clients and certain legacy applications that still depend on the NetBIOS encapsulation.

In modern Windows networks, ports 139 and 445 typically coexist, with port 445 carrying the bulk of the traffic and port 139 serving as a fallback. Disabling NetBIOS over TCP/IP entirely on internet-facing interfaces is now common practice in security-conscious environments, which closes port 139 along with ports 137 and 138.

Inbound port 139 from the public internet is unusual in 2026 and is generally treated as a serious exposure, similar in significance to inbound port 445. Outbound port 139 from end-user devices is normal within a Windows local network and uncommon to internet destinations.

Port 139 is also defined for UDP in the IANA registry, but UDP/139 is not used in practice.

About TCP Port 139

The Internet Assigned Numbers Authority (IANA) registers port 139 for netbios-ssn. The IANA description reads: ‘NETBIOS Session Service’.

Security Considerations

Port 139 carries the same SMB-based attack surface as port 445, with most of the same threat history applying to both. Where port 445 carries SMB directly over TCP, port 139 carries SMB inside the older NetBIOS Session Service wrapper. From an attacker’s perspective, both ports lead to the same SMB protocol on the target system; what differs is the framing of the network packets, not the underlying protocol commands or the vulnerabilities they expose.

Our data shows 118 IDS rules referencing port 139, with trojan-activity and protocol-command-decode classtypes leading the count. Sample rules detect classic SMB enumeration techniques including the OS-WINDOWS NT NULL session attack (an anonymous SMB connection used to enumerate users, shares, and other system information from older Windows servers), DCERPC NetrShareEnum probes for share discovery, SMB directory traversal attempts, and overflow attacks against the Samba server software on Linux and Unix systems. Several SQL Server-related rules also appear, reflecting the use of SMB-accessible named pipes to invoke stored procedures like sp_start_job and sp_password on misconfigured database servers.

Curated malware families on port 139 overlap heavily with those on port 445, including the Duqu espionage framework (MITRE S0038), the BlackEnergy intrusion framework (MITRE S0089), the Regin espionage platform (MITRE S0019), and the Locky ransomware family. The presence of these families on the older NetBIOS transport reflects the reality that targeted intrusion frameworks generally support both 139 and 445 as SMB delivery channels, falling back as needed against networks that block one but not the other.

The 2017 EternalBlue events that defined port 445 also affected port 139. The underlying SMB vulnerability (CVE-2017-0144) was reachable through both transports, and Microsoft’s MS17-010 patch addressed both. Defenders responding to WannaCry and NotPetya were advised to block both ports at network boundaries.

Common practice today is the same as for port 445: do not expose port 139 to the public internet. Most ISPs filter ports 137-139 at their network edges, most home routers block them by default, and most modern Windows configurations restrict NetBIOS over TCP/IP to internal interfaces only. Inbound port 139 from the public internet to any host is a strong indicator of either a serious misconfiguration or an active attack scan.

IDS Rule References

117 IDS / security rules reference TCP port 139. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.

Rule categories (top 6): trojan-activity (40), protocol-command-decode (35), attempted-user (12), attempted-recon (9), attempted-admin (6), attempted-dos (2).

Sample rule descriptions for TCP port 139:

• OS-LINUX x86 Linux samba overflow
• NETBIOS DCERPC NCACN-IP-TCP srvsvc NetrShareEnum null policy handle attempt
• OS-WINDOWS NT NULL session
• NETBIOS SMB CD..
• NETBIOS SMB CD…

Malware Activity

A meaningful share of monitored traffic on this port involves malware indicators.

42 of 117 IDS rules for TCP port 139 involve malware activity.

Families observed (top 8): Duqu (12), Skeleton (9), CryptXXX (3), Locky (3), BlackEnergy (2), PcClient.bal (2), Regin (2), ExtraPulsar (1), and 4 more families.

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), Snort Community Rules (GPLv2), and MITRE ATT&CK (Apache 2.0).