137
Summary
- // if you see it open
- Unauthenticated and unencrypted. An NBNS query against an open service can leak computer names, logged-in usernames, workgroup/domain names, MAC addresses, and share listings without credentials (reconnaissance via nbtscan, nmblookup, nbtstat, nmap -sU). Internet-exposed NBNS is abused for DDoS reflection/amplification (factor ~2.56:1-3.85:1, per NCSC Ireland). Named vulnerability CVE-2000-0673 (NetBIOS Name Spoofing, 2000): spoofed 'Name Conflict' packets force Windows 2000 / NT 4.0 hosts to drop their NetBIOS names (DoS); affects only obsolete OS versions. Guidance: block ports 137-139 at the perimeter and disable NetBIOS over TCP/IP where DNS is available.
- // analyst note
- A responsive port 137 on the public internet is a hardening finding — block 137–139 at the perimeter and disable NetBIOS over TCP/IP where DNS is available; treat exposure as recon-prone and reflection-abusable.
About port 137/tcp.
Port 137/tcp is registered with IANA as netbios-ns with the description "NETBIOS Name Service," dual-registered on both TCP and UDP. The IANA registry leaves the Assignee, Registration Date, Modification Date, and Reference columns blank for this entry — those are recorded nulls, not missing research. The protocol behind it is the NetBIOS Name Service (NBNS), the name-resolution component of NetBIOS-over-TCP/IP (NBT / NetBT) defined in RFC 1001 (concepts and methods) and RFC 1002 (detailed specifications). NBNS maps 16-character NetBIOS names to IP addresses, serving the same role for legacy Windows networking that DNS serves for the internet. The important practical nuance for an analyst is that although TCP 137 is formally assigned for protocol completeness, real-world NBNS traffic runs almost exclusively over UDP 137 — a responsive TCP 137 is rare, and nmap requires the -sU flag to probe the live UDP side. The reason port 137 matters is overwhelmingly security: NBNS answers with zero authentication and no encryption, so a query against an open service can leak computer names, logged-in usernames, workgroup/domain names, MAC addresses, and share listings without credentials, which is why nbtscan, nmblookup, nbtstat, and nmap all target it during reconnaissance. Internet-exposed NBNS is also abused as a DDoS reflection/amplification vector (amplification factor roughly 2.56:1–3.85:1 per NCSC Ireland). The named historical vulnerability is CVE-2000-0673, NetBIOS Name Spoofing, where spoofed "Name Conflict" packets force Windows 2000 / NT 4.0 hosts to drop their NetBIOS names (denial of service; affects only obsolete OS versions). Standard guidance is to block ports 137–139 at the perimeter and disable NetBIOS over TCP/IP wherever DNS is available, so a responsive port 137 on the public internet should be treated as a hardening finding.
- IANA assignment
netbios-ns— "NETBIOS Name Service"; reference (blank — no RFC cited in IANA registry); assignee (blank); dual-registered 137/tcp + 137/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry lines 351–352)- Range class
- well-known (0–1023) [Confirmed] — port number 137 is within 0–1023
- Related ports
- the NetBIOS/SMB cluster 137 (name), 138 (datagram), 139 (session); modern SMB on 445 [Confirmed]
Primary use
NetBIOS Name Service (NBNS), the name-resolution layer of NetBIOS-over-TCP/IP (RFC 1001 / RFC 1002); resolves 16-char NetBIOS names to IPs, analogous to DNS for legacy Windows networking
Common software
Microsoft Windows (NetBIOS over TCP/IP, legacy/on by default on older releases); Samba on Linux/Unix via the nmbd daemon; any NetBIOS-API application; superseded by DNS in modern networks
Security implications
unauthenticated, unencrypted; NBNS queries leak computer/user/domain names, MAC addresses, and share lists (recon via nbtscan / nmblookup / nbtstat / nmap); internet-exposed NBNS used for DDoS reflection (amplification ~2.56:1–3.85:1)
Exposure / scanning
included in internet-wide scan port lists (Censys/Shodan/research scanners); specific 2025 host-count stats for TCP 137 not found this pass
- TCP vs UDP in practice
- TCP 137 is formally assigned but rarely open; nearly all NBNS traffic is UDP 137 (nmap needs
-sUto probe it) [Likely] — en.wikipedia.org/wiki/NetBIOS_over_TCP/IP - Named vulnerability
- CVE-2000-0673 (NetBIOS Name Spoofing, 2000) — spoofed "Name Conflict" packets force Windows 2000 / NT 4.0 to drop NetBIOS names (DoS); affects only obsolete OS versions; CVSS ~5.0 Medium [Threat-reported] — Huntress threat library, NVD
- Analyst note
- A responsive port 137 on the public internet is a hardening finding — block 137–139 at the perimeter and disable NetBIOS over TCP/IP where DNS is available; treat exposure as recon-prone and reflection-abusable.
About port 137/udp.
Port 137/udp is registered with IANA as netbios-ns with the description "NETBIOS Name Service," a blank assignee, and a blank reference field (dual-registered on TCP and UDP, but the name service operates over UDP 137, which is why this entry is the UDP one). NetBIOS Name Service (NBNS, the WINS client protocol) handles NetBIOS name registration and resolution — mapping NetBIOS names to IP addresses on a local network — and is defined in RFC 1001/1002 (NetBIOS over TCP/IP, March 1987); it is the legacy predecessor to LLMNR (UDP 5355) and mDNS (UDP 5353), and tools like nbtstat, nmblookup, and nbtscan query it. The IANA reference field is blank. The security relevance of UDP 137 is large in internal Active Directory environments, on three fronts. First and most important is LLMNR/NBT-NS poisoning: because NBT-NS is unauthenticated, any host on the subnet can answer a broadcast name query, and attackers run Responder (or Inveigh, NBNSpoof, or Metasploit modules) to spoof responses to NBT-NS queries on UDP 137 and to LLMNR on UDP 5355, capturing victims' NetNTLMv2 hashes that are then cracked offline (hashcat module 5600) or relayed via SMB — a foundational AD attack cataloged as MITRE ATT&CK T1557.001, mitigated by disabling LLMNR and NBT-NS via Group Policy. Second, NBNS is a UDP amplification/reflection DDoS vector, listed in US-CERT/CISA TA14-017A at a bandwidth amplification factor of about 3.8. Third, NetBIOS name enumeration via nbtscan, nbtstat, or Nmap's nbstat NSE reveals hostnames, workgroup or domain, the logged-in user, and the MAC address without authentication. For an analyst, an open UDP 137 marks a Windows or Samba host with NetBIOS name service exposed — a prime internal-AD credential-theft surface and a name-enumeration and amplification liability.
- IANA assignment
netbios-ns— "NETBIOS Name Service"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 137/tcp + 137/udp (NBNS operates over UDP) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- commonly open on Windows hosts (NBT enabled by default); enumerated via
nmap -sU -p137(de-facto) [Well-established] — nmap-services file - Related ports
- 138/udp (netbios-dgm), 139/tcp (netbios-ssn), 445 (SMB direct), 5355 (LLMNR), 5353 (mDNS)
Primary use
NetBIOS name registration/resolution (NBNS / WINS client), RFC 1001/1002
Other/unofficial uses
nbtstat/nbtscan enumeration queries [Well-established]
Security implications
LLMNR/NBT-NS poisoning (Responder) → NetNTLMv2 capture/relay (MITRE T1557.001; hashcat 5600); UDP amplification (TA14-017A NetBIOS BAF ~3.8); unauthenticated name enumeration (hostnames, domain, user, MAC)
Typically seen on
Windows hosts and Samba (nmbd)
- Analyst note
- An open UDP 137 = a Windows/Samba host with NetBIOS name service exposed — a prime internal-AD credential-theft surface (Responder) and a name-enumeration/amplification liability.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| netbios-ns | UDP | NETBIOS Name Service | 36.52% |
| netbios-ns | TCP | NETBIOS Name Service | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.