445
Summary
- // if you see it open
- The dominant file-sharing attack surface. EternalBlue (MS17-010 / CVE-2017-0144), an SMBv1 integer-overflow RCE, patched 14 Mar 2017 and leaked by the Shadow Brokers 14 Apr 2017, powered WannaCry (12 May 2017, ~200K–230K systems across ~150 countries — NHS/FedEx/Telefónica) and NotPetya (27 Jun 2017, a wiper via M.E.Doc + EternalBlue/EternalRomance, >$10B damage, attributed to GRU Sandworm). SMBGhost/CoronaBlue (CVE-2020-0796), a wormable SMBv3.1.1 compression pre-auth RCE, patched out-of-band Mar 2020 (Win10/Server 1903/1909); SMBleed (CVE-2020-1206) info disclosure. SMBv1 not default-installed since Win10/Server 1709 (2017). Null sessions, SMB relay. 445 must NEVER be internet-exposed; ISPs/ISACs block it at the edge; among the most-attacked ports.
- // common applications
- Microsoft WindowsSamba
- // analyst note
- An open 445 ≈ a Windows host, Samba server, or NAS offering SMB — a critical perimeter finding if untrusted-reachable and a top worm/ransomware lateral-movement target. Patch (MS17-010, CVE-2020-0796), disable SMBv1, enforce signing/encryption, and confirm it is not internet-reachable.
About port 445/tcp.
Port 445/tcp is registered with IANA as microsoft-ds with the description "Microsoft-DS," assignee Pradeep Bahl, and a blank reference field (dual-registered on TCP and UDP). It is the port for SMB (Server Message Block) / CIFS carried directly over TCP — "direct hosting" of SMB without the NetBIOS session layer — and it is foundational to Windows file and printer sharing, named pipes, RPC-over-SMB, and Active Directory operations such as authentication, replication, and Group Policy, as well as to Samba on Unix/Linux and to NAS devices. Direct hosting was introduced in Windows 2000; per Microsoft's [MS-SMB] specification the SMB server listens on port 445, prepending a four-byte Direct-TCP header to each message, in contrast to the older NetBIOS Session Service transport on port 139 (modern Windows prefers 445 and falls back to 139 for legacy). SMB itself evolved from SMB1/CIFS through SMB2 (Windows Vista / Server 2008) to SMB3 (Windows 8 / Server 2012), which added end-to-end encryption. The IANA reference field is blank. Port 445 is the single most consequential file-sharing attack surface on the internet. EternalBlue (MS17-010, CVE-2017-0144) was an NSA-developed exploit of an integer-overflow flaw in the SMBv1 server, patched by Microsoft on 14 March 2017 and then leaked publicly by the Shadow Brokers on 14 April 2017; it enabled unauthenticated remote code execution against a vulnerable SMBv1 server on 445. It powered WannaCry on 12 May 2017 — a ransomware worm that hit on the order of 200,000–230,000 systems across roughly 150 countries in a day, including the UK's NHS, FedEx, and Telefónica — and NotPetya on 27 June 2017, a destructive wiper masquerading as ransomware (seeded via the Ukrainian M.E.Doc update and spreading via EternalBlue/EternalRomance plus credential theft) whose total damages exceeded $10 billion and which the US, UK, and allies attributed to Russia's GRU "Sandworm." Later came SMBGhost / CoronaBlue (CVE-2020-0796), a wormable pre-auth RCE in SMBv3.1.1 compression patched out-of-band in March 2020 (Windows 10/Server 1903 and 1909), and the related SMBleed information-disclosure flaw (CVE-2020-1206). SMBv1 has not been installed by default since Windows 10/Server 1709 (2017), which removes the EternalBlue/NotPetya propagation vector. The universal guidance is that 445 must never be internet-exposed: most consumer ISPs and ISACs block it at the edge, and it is among the most-attacked and most-scanned ports in existence. For an analyst, an open 445 marks a Windows host, Samba server, or NAS offering SMB; it is a critical perimeter finding if reachable from untrusted networks and a top worm and ransomware lateral-movement target, so verify patch status (MS17-010, CVE-2020-0796), disable SMBv1, enforce SMB signing/encryption, and confirm it is not internet-reachable.
- IANA assignment
microsoft-ds— "Microsoft-DS"; reference (blank — no RFC cited in IANA registry); assignee Pradeep Bahl; dual-registered 445/tcp + 445/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- one of the most commonly open and most-scanned ports; nmap top ~9 open TCP ports (de-facto) [Well-established] — nmap-services file
- Related ports
- 139 (NetBIOS-SSN / legacy NBT transport), 137 (NetBIOS-NS), 138 (NetBIOS-DGM), 135 (MS-RPC endpoint mapper) — the SMB/RPC cluster; 445/udp sibling
Primary use
SMB/CIFS file & printer sharing, named pipes, RPC-over-SMB, AD operations — direct-hosted over TCP ([MS-SMB])
Other/unofficial uses
Samba; NAS; SMB-based backup/replication [Well-established]
Security implications
EternalBlue (MS17-010/CVE-2017-0144, SMBv1, patched 14 Mar 2017; Shadow Brokers leak 14 Apr 2017) → WannaCry (12 May 2017, ~200K–230K systems/~150 countries) and NotPetya (27 Jun 2017, >$10B); SMBGhost/CoronaBlue (CVE-2020-0796, SMBv3.1.1 compression, Mar 2020, wormable); SMBleed (CVE-2020-1206); SMBv1 not default-installed since Win10/Server 1709; null sessions/SMB relay; NEVER internet-expose; ISPs block at edge
Typically seen on
Windows hosts (DCs, file servers, workstations), Samba servers, NAS
- Analyst note
- An open 445 ≈ a Windows host, Samba server, or NAS offering SMB — a critical perimeter finding if untrusted-reachable and a top worm/ransomware lateral-movement target. Patch (MS17-010, CVE-2020-0796), disable SMBv1, enforce signing/encryption, and confirm it is not internet-reachable.
About port 445/udp.
Port 445/udp is registered with IANA as microsoft-ds with the description "Microsoft-DS," assignee Pradeep Bahl (Microsoft), and a blank reference field; it is the UDP half of an identical dual TCP/UDP registration (445/tcp carries the same service name, description, and assignee). The TCP side is the well-known SMB "direct host" port: starting with Windows 2000, Server Message Block was carried directly over TCP/445 instead of being tunneled through NetBIOS over TCP (ports 137–139), letting Windows file and printer sharing, Active Directory, and Samba reach a server without the legacy NetBIOS session layer. The UDP registration is essentially vestigial. SMB requires a reliable, connection-oriented, authenticated session, which is a TCP property; Microsoft's own direct-hosting documentation and independent SMB references describe the protocol running over 445/tcp, and there is no documented production implementation that carries SMB traffic over 445/udp in modern Windows (Vista/SMB 2.x and later) or Samba. For an analyst, the UDP port matters mostly because port 445 as a number is one of the most heavily probed targets on the public internet — driven by the SMB worm/ransomware lineage on the TCP side: EternalBlue/WannaCry (2017, MS17-010), Conficker (account-lockout password guessing), Sasser (MS04-011 LSASS), and W32.Randex.B (dictionary-attack propagation). The SANS Internet Storm Center consistently records very high daily report volumes against port 445, and automated scanners sweep the UDP port alongside the TCP one even though no UDP-specific exploitation vector is documented. The security consensus is unambiguous: port 445 must never be exposed to the public internet and should be blocked at the network perimeter. The IANA reference field is blank — no RFC is cited in the registry — so a responsive or scanned 445/udp should be read as a co-registration artifact and a scanning magnet rather than evidence of a live UDP SMB service.
- IANA assignment
microsoft-ds— "Microsoft-DS"; reference (blank — no RFC cited in IANA registry); assignee [Pradeep_Bahl]; dual-registered 445/tcp + 445/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Registration metadata
- registration date, modification date, and reference are all genuinely blank in the IANA CSV (recorded as null, not unknown) [Confirmed] — IANA service-names CSV (line 909)
- Related ports
- 139/tcp (NetBIOS session / legacy SMB), 137/138 (NetBIOS name/datagram); 445/tcp (the active SMB direct-host port)
Primary use
UDP co-registration of the SMB direct-hosting port; SMB itself runs over 445/tcp — no documented production use of 445/udp
Common software
Windows File and Printer Sharing (SMB/CIFS), Samba, Active Directory domain services — all on 445/tcp in practice; 445/udp carries no known active implementation
Security implications
port 445 (number) is among the most-scanned on the internet; SMB worm/ransomware lineage (WannaCry/EternalBlue MS17-010, Conficker, Sasser MS04-011, W32.Randex.B); SANS ISC records very high daily report volumes; must not be exposed to the public internet; no UDP-specific exploitation vector documented
Typically seen on
Windows/Samba hosts (on TCP); on UDP, scanner sweeps rather than a live service
- Analyst note
- Treat an open/scanned 445/udp as a co-registration artifact and a scanning magnet, not a live UDP SMB service; firewall port 445 at the perimeter regardless of transport.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| microsoft-ds | UDP | — | 25.31% |
| microsoft-ds | TCP | SMB directly over IP | 5.69% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.