138

Port 138 is registered with IANA as netbios-dgm ("NETBIOS Datagram Service"), dual-registered on both 138/tcp and 138/udp with the Assignee, Contact, Registration Date, Modification Date, and Reference fields all blank in the registry. It is part of the NetBIOS over TCP/IP (NBT) suite whose protocol behavior is defined in RFC 1001/1002, though IANA cites no RFC reference for the port-138 assignment itself, so the reference field is recorded blank. The practical detail an analyst needs is that the NetBIOS Datagram Distribution Service (NBDGM) is, in every real implementation, a UDP-only service: legitimate NetBIOS datagram traffic flows over 138/udp, and 138/tcp carries no known legitimate traffic. A responsive 138/tcp on a live host is therefore anomalous and worth investigating. The connectionless datagram service supports subnet-scoped broadcast — most visibly the Windows Browser Service announcements that populate "Network Neighborhood," plus quick membership/status notifications — and is implemented by Windows (when NetBIOS over TCP/IP is enabled) and by Samba on Unix/Linux. The protocol is unauthenticated and unencrypted: broadcast datagrams leak machine names, workgroup/domain membership, and resource availability to the whole subnet (CVE-1999-0519 documents NetBIOS information disclosure), and the port is a standard reconnaissance target probed with nmap -sU -p 138 and nbtscan -r. Note that the high-profile SMB RCE CVEs — EternalBlue (CVE-2017-0143) and SMBGhost (CVE-2020-0796) — operate via 139/445, not 138; port 138 is an enumeration and recon surface, not a direct code-execution vector. Both Microsoft and the Samba project treat NBT ports 137–139 as legacy, recommending SMB directly over 445/tcp; Windows Vista and later attempt 445 first, and CIS/Microsoft hardening guidance is to disable NetBIOS over TCP/IP and block 137–139 at the perimeter where legacy compatibility is not required.

IANA assignment

netbios-dgm — "NETBIOS Datagram Service"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 138/tcp + 138/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, 138/tcp + 138/udp)

Range class

well-known (0–1023) [Confirmed]

Primary use

NetBIOS Datagram Distribution Service (NBDGM) — connectionless, subnet-scoped broadcast for the Windows Browser Service and quick membership/status notifications; UDP-only in practice

Other/unofficial uses

Windows Browser Service announcements; small connectionless resource-membership notifications

Common software

Windows (when NetBIOS over TCP/IP is enabled) and Samba on Unix/Linux; legacy-only in modern deployments

Security implications

unauthenticated/unencrypted; broadcast datagrams leak machine names, workgroup/domain membership and resource availability (CVE-1999-0519 NetBIOS information disclosure); standard recon/enumeration target; DoS via crafted datagrams (CVE-1999-0153 OOB NetBIOS data); SMB-relay/spoofing surface in combination with 139/445. EternalBlue (CVE-2017-0143) and SMBGhost (CVE-2020-0796) exploit 139/445, NOT 138

Exposure/scanning notes

probed with nmap -sU -p 138 and nbtscan -r <subnet>; LAN-scoped so less internet-exposed than 139/445; CIS/Microsoft guidance is to disable NBT and block 137–139 at the perimeter

TCP vs UDP

IANA names both 138/tcp and 138/udp netbios-dgm, but the service is UDP-only in every real implementation; 138/tcp carries no known legitimate traffic and an open 138/tcp is anomalous [Confirmed] — IANA registry; pentestpad.com port-138

Underlying protocol

NetBIOS over TCP/IP (NBT), defined in RFC 1001/1002; these RFCs are not cited by IANA for the port-138 assignment [Likely] — RFC 1001/1002 (protocol suite); IANA registry (reference field blank)

Legacy/modern status

legacy — Microsoft and Samba recommend SMB over 445/tcp; Windows Vista+ attempt 445 first; NBT (and port 138) retained only for backward compatibility [Confirmed] — sysadminsage.com

Analyst note

legitimate NetBIOS datagram traffic is UDP; treat any open 138/tcp as anomalous and investigate. An open 138/udp on an internet-facing host usually indicates an unhardened legacy Windows/Samba box.

Port 138/udp is registered with IANA as netbios-dgm, described as "NETBIOS Datagram Service," with the assignee, contact, dates, and reference columns all left blank in the registry. The service is one of the three pillars of NetBIOS over TCP/IP (NetBT) defined in RFC 1001 and RFC 1002 (March 1987): the Name Service runs on UDP 137, the Datagram Service on UDP 138, and the Session Service on TCP 139. The Datagram Service is connectionless and broadcast-capable — it carries no persistent connection and pushes responsibility for error detection up to the application — and it is what drives legacy Windows workgroup behaviour such as host announcements, "Network Neighborhood"/browser elections, and logon-script and mailslot traffic on a local subnet. Its core primitives are Send Datagram, Send Broadcast Datagram, Receive Datagram, and Receive Broadcast Datagram. For an analyst, 138/udp is primarily a legacy and exposure signal. Modern Windows resolves names through DNS (and mDNS/DNS-SD) and speaks SMB directly over TCP 445, so a host actively using UDP 138 is typically older, a Samba server, or an embedded/IoT device that ships with NetBIOS enabled by default. The security concern is concrete: broadcast datagrams leak hostnames, workgroup names, and user details to the whole subnet (trivial enumeration with nbtscan or nmap -sU -p 138), the protocol has no authentication so any subnet host can impersonate a NetBIOS name, and 137/138 enumeration is a routine first step in NTLM-relay chains that ultimately target SMB on 139/445. The direct historical CVE is CVE-1999-0519 (information disclosure via the NetBIOS Datagram Service); the better-known EternalBlue/WannaCry (CVE-2017-0143/0144) and SMBGhost (CVE-2020-0796) flaws belong to the SMB stack on 139/445, not to UDP 138 itself. Best practice is to block UDP 137–138 and TCP 139 at the perimeter and disable NetBIOS over TCP/IP where it is not required. Port 138/tcp is also registered with the same service name and description, though the datagram service runs over UDP in practice.

IANA assignment

netbios-dgm — "NETBIOS Datagram Service"; reference (blank — no RFC cited in IANA registry); assignee/contact/dates (blank); dual-registered 138/tcp + 138/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry; the IANA Service Name and Transport Protocol Port Number Registry line 354

Range class

well-known (0–1023) [Confirmed]

Related ports

137/udp (netbios-ns), 139/tcp (netbios-ssn), 445/tcp (microsoft-ds / SMB)

Primary use

NetBIOS Datagram Service — connectionless, broadcast-capable datagram delivery for NetBIOS host announcements, browser/workgroup traffic, and mailslots on a local subnet (NetBT; RFC 1001/1002)

Other/unofficial uses

Windows File Sharing / Network Discovery (workgroups); Samba; legacy network printers, Lotus Notes, Novell NetWare, and legacy SQL Server name resolution

Security implications

broadcast datagrams leak hostnames/workgroups/user details to the subnet (low-effort enumeration); no authentication enables NetBIOS-name spoofing; 137/138 enumeration is a common first step in NTLM-relay chains targeting SMB on 139/445 [Confirmed] — https://scanitex.com/en/resources/ports/udp/138, https://www.pentestpad.com/port-exploit/port-138-netbios-datagram-service

Typically seen on

legacy Windows workgroup hosts, Samba servers, embedded/IoT devices with NetBIOS enabled

Modern relevance

legacy — superseded by DNS-based resolution (DNS-SD/mDNS) and SMB over TCP 445; lingers on unpatched/legacy Windows, Samba servers, and NetBIOS-on-by-default embedded/IoT devices [Confirmed] — https://www.pentestpad.com/port-exploit/port-138-netbios-datagram-service, https://scanitex.com/en/resources/ports/udp/138

Direct CVEs

CVE-1999-0519 (information disclosure via NetBIOS Datagram Service); CVE-1999-0471 (reported across UDP 137/138 and TCP 139) [Likely] — https://scanitex.com/en/resources/ports/udp/138, https://www.pentestpad.com/port-exploit/port-138-netbios-datagram-service

Not native to 138/udp

EternalBlue/WannaCry (CVE-2017-0143/0144) and SMBGhost (CVE-2020-0796) are SMBv1/v3 flaws on TCP 139/445 — port-family-associated, not UDP 138 vulnerabilities [Confirmed] — NVD

Analyst note

an open UDP 138 facing untrusted networks is a legacy/exposure flag — block 137–138/UDP and 139/TCP at the boundary and disable NetBIOS over TCP/IP where unneeded.