What are ports 137-139 used for?
Ports 137, 138 and 139 are NetBIOS over TCP/IP, the legacy Windows system for finding computers by name and sharing files and printers on a local network. 137 is the name service, 138 the datagram service and 139 the session service.
On old Windows versions, file sharing (SMB) ran on top of a NetBIOS session on port 139. Windows 2000 and later can send SMB directly over TCP 445 and use DNS for names, so NetBIOS is needed only for old systems and devices. It is chatty and trusting: name queries are broadcast to the whole subnet and any machine can answer, which attackers use to impersonate servers and capture sign-in attempts. These ports should never be reachable from the internet.
Are ports 137-139 TCP or UDP?
Both, depending on the port. Name resolution uses UDP 137, the datagram service UDP 138, and the session service, which carries file sharing, TCP 139.
Is there a secure version of NetBIOS on ports 137-139?
No. NetBIOS has no encrypted form. The modern path is SMB directly on TCP 445, which supports signing and SMB 3 encryption, with DNS for name resolution. Where nothing old depends on it, NetBIOS over TCP/IP is disabled.
Port 139 vs port 445: what is the difference?
Both carry Windows file sharing. On 139, SMB runs inside a NetBIOS session, the old method. On 445, SMB runs directly over TCP, which is what current Windows versions use. Port 445 explained
Which CompTIA exams list ports 137-139?
CompTIA lists ports 137-139 by number in the A+ objectives (Core 1); the Network+ port list does not include them.
- A+ Core 1 220-1201: objective 2.1 (Networking), listed as “137-139, Network Basic Input/Output System (NetBIOS)/NetBIOS over TCP/IP (NetBT)”.
The quoted text is how the objectives document lists the port. The exam puts the port in a scenario, such as a firewall rule or a failed connection; it does not only ask for the number.
Check yourself: a practice question
Written by CertSprint for this page. It is not taken from any exam.
A security review recommends disabling NetBIOS over TCP/IP on a network where every machine runs a current Windows version and uses DNS. What keeps file sharing working?
- SMB directly over TCP 445
- Telnet on port 23
- TFTP on port 69
- POP3 on port 110
Show the answer
A. SMB directly over TCP 445. Current Windows versions use direct-hosted SMB on 445 and do not need the NetBIOS session service on 139.
Sources: IANA Service Name and Transport Protocol Port Number Registry: port 137; RFC 1001: Protocol Standard for a NetBIOS Service on a TCP/UDP Transport: Concepts and Methods; Microsoft Learn: Service overview and network port requirements for Windows; Microsoft Learn: Direct hosting of SMB over TCP/IP; MITRE ATT&CK T1557.001: LLMNR/NBT-NS Poisoning and SMB Relay. The port number and how each exam lists it come from CompTIA's exam objectives, linked from the study plans above. The explanation and the question are CertSprint's own, checked against these sources on 12 November 2026.