# Ports 139 and 445 (SMB/NetBIOS) Explained — and Why to Block Them

> A plain-English explainer on TCP ports 139 and 445: what SMB and NetBIOS are, why port 445 (and the legacy NetBIOS port 139) are high-risk, the EternalBlue and WannaCry context, why they should never face the internet, and the firewall and segmentation controls that keep them safe.

Source: https://playciso.com/blog/smb-ports-139-445-explained · Published: 2026-10-23 · Publisher: PlayCISO (https://playciso.com)

---

Ports 139 and 445 are the TCP ports behind Windows file and printer sharing. Port 445 carries the Server Message Block (SMB) protocol directly over TCP; port 139 carries the older SMB-over-NetBIOS path. They are everyday infrastructure on a Windows network — and, when exposed or left unpatched, among the most reliably dangerous things on it. ## What SMB and NetBIOS actually are **SMB (Server Message Block)** is the protocol Windows uses to share files and printers, pass named pipes between processes, and carry administrative connections such as the hidden ADMIN$ and IPC$ shares. When you map a network drive or open `\\server\share`, SMB is doing the work. **NetBIOS** is an older session and name-resolution layer that SMB used to ride on top of. It uses UDP 137 and 138 for name resolution and datagrams and TCP 139 for the session itself. Modern SMB no longer needs it: since Windows 2000, SMB can run directly over TCP on **port 445**, and that is the port that matters most today. Port 139 lingers for backward compatibility. In short: NetBIOS is legacy plumbing, SMB is the service, 139 is SMB-over-NetBIOS and 445 is SMB-direct. ## Why 445 and 139 are high-risk SMB is not a trivial protocol. It is authenticated, it reaches the file system, and it moves inter-process communication around. That richness is exactly what makes a flaw in the SMB service so damaging — a single bug can mean remote code execution at system privilege, with no user interaction. The defining example is **EternalBlue**, a vulnerability in the obsolete SMBv1 dialect that Microsoft patched in bulletin MS17-010. In 2017 the **WannaCry** ransomware worm and, shortly after, **NotPetya** weaponised it: once on a network, they scanned for other machines listening on port 445 and exploited unpatched SMBv1 to spread automatically, host to host, with no human needed. That self-propagation across port 445 is why these outbreaks moved through organisations so fast. The lesson was blunt — an exploitable SMB service plus network reachability equals a worm highway. Beyond headline vulnerabilities, exposed SMB invites credential brute-forcing, and the legacy SMBv1 dialect is weak in its own right. Mapping which attacks a given exposure actually enables is the kind of question a structured [threat model](/tools/threat-model) answers before an incident, not after. ## These ports must never face the internet There is no legitimate reason for a Windows SMB port to be reachable from the public internet. SMB is a local-network protocol; exposing it externally hands the entire internet direct access to your file shares and to an authenticated, code-touching service with a long history of critical flaws. Many ISPs and cloud providers block inbound 445 at their own edge precisely because the exposure is so consistently abused. If you genuinely need file access across the internet, put it behind a VPN or use a purpose-built secure file service — never a raw SMB port. Treat any SMB port you find facing the internet as an incident to close, not a setting to tweak. The same discipline applies to other services that were only ever meant for a trusted LAN, such as the file-sharing shortcuts described in [our UPnP explainer](/blog/what-is-upnp). ## How to defend SMB properly - Block 139 and 445 inbound at the perimeter. No exceptions for the public internet. This is the single most important control and it is free. - Disable SMBv1 entirely. It is the dialect that carried EternalBlue and has no place on a modern system. Remove the feature rather than merely hoping nothing negotiates it. - Patch promptly. SMB flaws are high-value targets; the gap between a patch shipping and worms using the old bug is where organisations get hurt. - Segment the internal network. Even inside the LAN, SMB should flow only between hosts that genuinely share files, not flat across every subnet. Segmentation is what stops a single compromised laptop from reaching every server on 445 — the same containment principle at the heart of zero trust and defense in depth. - Require SMB signing. Signing resists tampering and relay attacks against SMB sessions. - Restrict by host firewall. Lock down which specific machines may reach a server's SMB port, so the service answers only the clients that are supposed to use it. ## The takeaway Ports 139 and 445 are the backbone of Windows file sharing, and that is exactly why they are dangerous when mishandled. SMB is powerful enough that a single flaw can mean full compromise, and reachable enough that worms like WannaCry turned port 445 into a spreading mechanism. Keep both ports off the internet, kill SMBv1, patch, segment and sign — and a protocol that has caused some of the worst outbreaks in history becomes a quiet, controlled, internal-only service. ## Frequently asked questions **What are ports 139 and 445 used for?** Windows file and printer sharing over SMB. Port 445 carries SMB directly over TCP; port 139 carries the older SMB-over-NetBIOS session. Mapping a drive or reaching a share uses them. **What is the difference between SMB and NetBIOS?** SMB is the file-sharing protocol; NetBIOS is a legacy session and name layer SMB used to ride on (ports 137/138/139). Modern SMB runs directly on port 445 without NetBIOS. **Why are they high-risk?** SMB is an authenticated service that touches the file system, so a flaw can give remote code execution. EternalBlue (SMBv1, MS17-010) let WannaCry and NotPetya spread automatically across port 445 in 2017. **Should 445 ever face the internet?** No. There is no legitimate reason to expose a Windows SMB port publicly; block 139 and 445 inbound and use a VPN or secure file service for remote access. **How do you secure them?** Block them at the edge, disable SMBv1, patch, segment internal networks, require SMB signing, and restrict which hosts can reach each server's SMB port.