CyberHunter
Local dataset, no network
// Network services

Port 137: NetBIOS Name Service

NetBIOS name resolution (138 for datagrams).

137

How NetBIOS Name Service works

Network services
FILESRV ?me! FILESRV ?me!

A device asks the whole local network a question and the device that matches answers. It travels in clear text: anyone on the path can read it.

Transport
UDP · TCP
Exposure risk
6/10 high if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assigned1 registered service
Range
Well-known (0-1023)
Category
Network services
01 Security

Is port 137 dangerous?

Common attacks and weaknesses

  • NBT-NS poisoning to capture NTLM hashes; host enumeration.

How to secure it

  • Disable NetBIOS over TCP/IP where possible.
02 Registry

IANA registry entries for port 137

ServicePortTransportDescriptionReferenceUpdated
netbios-ns 137 TCP, UDP NETBIOS Name Service - -

// source: IANA service name and port number registry

03 Check it

Which program uses port 137, and is it reachable?

Linux

sudo ss -ltnup 'sport = :137'      # process listening on 137
sudo lsof -nP -i :137

macOS

sudo lsof -nP -i :137

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 137 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 137
netstat -ano | findstr :137

From another machine

nmap -p 137 -sV <host>
sudo nmap -sU -p 137 <host>
nc -zv <host> 137

Block it in the firewall

sudo ufw deny 137/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 137" -Direction Inbound -LocalPort 137 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 137 used for?

NetBIOS name resolution (138 for datagrams).

Is port 137 TCP or UDP?

Port 137 is registered for UDP and TCP. In practice the service mostly uses UDP.

Is it safe to open port 137?

It is rated 6/10 (high) when exposed to the Internet. NBT-NS poisoning to capture NTLM hashes; host enumeration. Disable NetBIOS over TCP/IP where possible.

How do I check if port 137 is open?

On Linux run "ss -ltnup 'sport = :137'", on macOS "lsof -nP -i :137", and on Windows "netstat -ano | findstr :137" to see the local process. From another machine, "nmap -p 137 <host>" shows whether it is reachable.

05 Related
:53 DNS tcp · udp · moderate risk :135 MS RPC tcp · udp · high risk :123 NTP udp · tcp · moderate risk :67 DHCP server udp · tcp · moderate risk :111 rpcbind tcp · udp · high risk :9100 Raw printing (JetDirect) tcp · udp · high risk :631 IPP / CUPS tcp · udp · high risk :5353 mDNS udp · tcp · moderate risk

Latest vulnerability news

All news