139

Port 139/tcp is registered with IANA as netbios-ssn with the description "NETBIOS Session Service," assignee Jon Postel, and a blank reference field (dual-registered on TCP and UDP, with the session service running over TCP 139). Defined in RFC 1001/1002, the NetBIOS Session Service establishes the sessions that carry SMB file and printer sharing over NetBIOS-over-TCP (NBT) — the legacy "SMB over NBT" transport. Historically SMB ran on top of NBT, using UDP 137/138 for name and datagram services and TCP 139 for sessions; Windows 2000 introduced "direct hosting" of SMB over TCP on port 445 (microsoft-ds), and since then port 139 has served as a fallback or legacy transport while clients prefer 445. The IANA reference field is blank. Security-wise, port 139 carries the classic SMB-over-NetBIOS attack surface. The best-known issue is the SMB null session: an unauthenticated connection to the hidden IPC$ share historically allowed enumeration of usernames, groups, shares, policies, and services, cataloged as CVE-1999-0519; it was default on NT and 2000, restricted by default from XP SP2 and Server 2003 onward, but frequently re-enabled by misconfiguration, and tools like enum4linux, smbclient, and rpcclient exploit it. The high-profile SMB worm and RCE history — MS08-067/Conficker, and MS17-010 "EternalBlue" driving WannaCry in May 2017 — is primarily centered on port 445, but it reaches the same SMB stack and MS03-026 explicitly named 139 as well, so the 139-and-445-together signature is the classic Windows fingerprint. Best practice is to disable SMBv1 and turn off NetBIOS-over-TCP where it is not needed, reducing the surface to 445 only. For an analyst, an open 139 marks a Windows or Samba host exposing legacy SMB-over-NetBIOS; check for null-session enumeration and SMBv1, reference 445 as the modern SMB transport, and — seen together with 135 and 137 — treat the host as having full legacy NetBIOS/RPC exposure and a perimeter red flag.

IANA assignment

netbios-ssn — "NETBIOS Session Service"; reference (blank — no RFC cited in IANA registry); assignee Jon Postel; dual-registered 139/tcp + 139/udp (session runs over TCP) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

among the more commonly open Windows ports; part of the 135/139/445 fingerprint (de-facto) [Well-established] — nmap-services file

Related ports

137/udp (name), 138/udp (datagram), 445 (SMB direct hosting — modern, future batch), 135 (RPC)

Primary use

SMB file/printer sharing sessions over NetBIOS-over-TCP (RFC 1001/1002)

Other/unofficial uses

legacy SMB transport (fallback to 445) [Well-established]

Security implications

SMB-over-NetBIOS null sessions / IPC$ enumeration (CVE-1999-0519); legacy SMB attack surface; worm/RCE history (MS08-067/Conficker, MS17-010/WannaCry May 2017) is mainly 445 but reaches the same stack (MS03-026 named 139); disable SMBv1 and NBT where unneeded

Typically seen on

Windows hosts (workstations, file servers, DCs) and Samba servers

Analyst note

An open 139 = a Windows/Samba host exposing legacy SMB-over-NetBIOS; check for null sessions and SMBv1, reference 445 as the modern transport. With 135/137/139 together, treat as full legacy NetBIOS/RPC exposure and a perimeter red flag.

Port 139/udp is registered with IANA as netbios-ssn with the description "NETBIOS Session Service," assigned to [Jon_Postel], and a blank reference field. The same name and description are dual-registered on 139/tcp. The UDP assignment is essentially a historical artifact: the NetBIOS Session Service is a connection-oriented protocol that requires a reliable byte stream, so it runs exclusively over TCP — the original blanket dual-assignment of both transports appears in RFC 1340 (Assigned Numbers, July 1992), which lists netbios-ssn 139/udp NETBIOS Session Service [JBP]. No mainstream operating system or application binds a listener on 139/udp. The genuinely active UDP NetBIOS ports are 137 (NetBIOS Name Service, name registration/resolution) and 138 (NetBIOS Datagram Service, connectionless messaging and browser broadcasts); SMB-over-NetBIOS file and printer sharing — the use case people associate with "port 139" — runs over 139/tcp on Windows and Samba. For an analyst, 139/udp is effectively unused. Scanners (nmap, Shodan, Censys) sweep it as part of broad NetBIOS probes, but responses are virtually never observed because nothing listens there. The serious exposure risk attached to port 139 — NetBIOS-over-TCP enabled by default on Windows, unauthenticated null sessions on older hosts, and NTLM relay for lateral movement — lives entirely on the TCP side. Modern environments prefer 445/tcp (Direct-hosted SMB), falling back to 139/tcp only for legacy compatibility. Microsoft and security guidance recommend blocking both 139/tcp and 139/udp at the perimeter, but the UDP block is a belt-and-suspenders measure rather than protection against live traffic.

IANA assignment

netbios-ssn — "NETBIOS Session Service"; reference (blank — no RFC cited in IANA registry); assignee [Jon_Postel]; dual-registered 139/tcp + 139/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (139/udp), :355 (139/tcp); IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023) [Confirmed]

Related ports

137/udp, 138/udp, 139/tcp (the active implementation), 445/tcp (Direct-hosted SMB, modern replacement)

Primary use

none in practice — NetBIOS Session Service is connection-oriented and runs over TCP; the UDP registration is a legacy IANA dual-assignment with no real-world listener

Security implications

no live 139/udp listener to attack; the real port-139 risk is TCP-side (default NetBIOS-over-TCP on Windows, unauthenticated null sessions leaking users/shares, NTLM relay for lateral movement); blocking 139/udp at the perimeter is a belt-and-suspenders measure [Likely] — https://learn.microsoft.com/en-us/answers/questions/3804422/windows-vulnerable-ports-exposed ; https://www.techtarget.com/searchsecurity/answer/The-dangers-of-open-port-139

Typically seen on

nothing in practice — scanners probe it but responses are virtually never observed

Active UDP NetBIOS ports instead

137/udp (Name Service), 138/udp (Datagram Service) — 139/udp is not where UDP NetBIOS traffic lives [Confirmed] — https://juggernaut-sec.com/ad-recon-netbios-smb-part-1/

Original reference

RFC 1340 lists netbios-ssn 139/udp NETBIOS Session Service [JBP]; current registry procedures governed by RFC 6335 (procedure, not protocol behavior) [Confirmed] — https://datatracker.ietf.org/doc/html/rfc1340

Registry-only fields (registration date, modification date, reference, service code, unauthorized-use-reported, assignment notes)

blank in the registry — recorded as null, not fabricated [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Analyst note

A "139/udp" hit is almost always a scanner artifact or a closed/filtered port. Investigate the TCP side (139/tcp, 445/tcp) for any real NetBIOS/SMB exposure.