Port 139 (NetBIOS Session Service)

SMB over NetBIOS, the older transport used before direct SMB on 445.

Well-known (system) port, 0-1023 TCP Windows networking Do not expose to the internet

What port 139 is used for

SMB over NetBIOS, the older transport used before direct SMB on 445.

Do not expose to the internet. Block at the perimeter. Modern Windows networks rarely need it; disabling NetBIOS over TCP/IP removes it entirely.

Service nameProtoDescriptionAssigneeReference

netbios-ssn TCP NETBIOS Session Service Jon Postel -

netbios-ssn UDP NETBIOS Session Service Jon Postel -

Linux: is anything listening on TCP 139?

sudo ss -tlnp 'sport = :139'

Linux / macOS: which process owns the port

sudo lsof -nP -i :139

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':139 '

Windows (Command Prompt)

netstat -ano | findstr :139

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 139 -State Listen | Select LocalAddress,OwningProcess

From another machine

nc -vz -w 5 HOST 139

From Windows

Test-NetConnection HOST -Port 139

ufw

sudo ufw deny 139/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 139 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 139 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 139' -Direction Inbound -Protocol TCP -LocalPort 139 -Action Block

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.