Port 139 is a legacy networking port primarily used for the NetBIOS Session Service. In the context of Windows operating systems, it facilitates communication between computers on a local area network (LAN) to enable resource sharing, such as accessing shared folders and using network printers. While it was a cornerstone of local networking for decades, its reliance on the aging Server Message Block (SMB) version 1 protocol has made it a significant security liability in modern computing environments.

Technical Definition of Port 139

Port 139 operates at the session layer of the OSI model when implementing NetBIOS over TCP/IP (NBT). It uses the Transmission Control Protocol (TCP) to ensure reliable, connection-oriented communication between two nodes. Unlike connectionless protocols that send data without verifying its receipt, Port 139 establishes a dedicated session, manages the data flow, and terminates the connection once the task is complete.

In a traditional Windows environment, Port 139 works in tandem with two other ports to provide a complete NetBIOS networking suite:

  • Port 137 (UDP/TCP): The NetBIOS Name Service, used for registering and resolving names.
  • Port 138 (UDP): The NetBIOS Datagram Service, used for connectionless browser services and "shouting" messages to the entire network.
  • Port 139 (TCP): The NetBIOS Session Service, where the actual reliable data transfer (like copying a file) occurs.

When a client wants to access a shared file on a server using Port 139, it first resolves the server's NetBIOS name via Port 137, then initiates a TCP handshake on Port 139 to begin the session.

The Evolution of NetBIOS and SMB

The history of Port 139 dates back to 1983 when Sytek Inc. developed NetBIOS (Network Basic Input/Output System) for IBM's early PC networks. At the time, networks were small—often fewer than a dozen computers—and operated in highly trusted environments. NetBIOS was not originally a routable protocol; it was designed to work on simple, flat network architectures.

As the internet and larger TCP/IP networks emerged, the industry needed a way to run these familiar NetBIOS services over the global standard protocol. This led to the publication of RFC 1001 and RFC 1002 in 1987, which defined NetBIOS over TCP/IP (NBT). This transition allowed Port 139 to carry SMB traffic across routed networks, effectively making Windows file sharing a global capability.

However, the "trust-by-default" design of the 1980s did not age well. The protocol lacked robust authentication and encryption, assuming that if you could reach the port, you were likely a legitimate user on the same physical wire.

Port 139 vs Port 445: The Critical Distinction

A common point of confusion for network administrators is the relationship between Port 139 and Port 445. Both are associated with SMB and file sharing, but they represent different eras of Windows networking.

The Port 139 Era (Legacy SMB)

Prior to Windows 2000, SMB required the NetBIOS layer to function over TCP/IP. This is often referred to as "SMB over NBT." Because NetBIOS names are limited to 15 characters plus a service byte, this method is restricted by the legacy naming conventions and the relative inefficiency of the NetBIOS session overhead.

The Port 445 Era (Direct Hosted SMB)

With the release of Windows 2000, Microsoft introduced "Direct Hosted SMB." This allowed the SMB protocol to run directly over TCP/IP without the need for the NetBIOS layer. By using Port 445, Windows could bypass the limitations of NetBIOS, utilizing DNS for name resolution instead of the "chatty" NetBIOS name service.

Modern Implementation

Today, when a modern Windows client (like Windows 11) attempts to connect to a file share, it simultaneously tries to connect via Port 445 and Port 139. If Port 445 responds, the system prefers it due to its better performance and support for modern SMB versions (SMB 2.x and 3.x). Port 139 is generally maintained only for backward compatibility with very old systems, such as Windows 98, Windows NT, or legacy industrial equipment.

How Port 139 Sessions Work

The mechanics of a Port 139 session involve several distinct primitives defined in the RFC standards. Understanding these helps in diagnosing network issues or identifying malicious traffic patterns.

  1. Call: The client initiates a session by sending a "Session Request" to the server's Port 139. This request includes the calling NetBIOS name (the client) and the called NetBIOS name (the server).
  2. Listen: The server must be in a "listening" state on Port 139, ready to accept incoming requests for its registered NetBIOS names.
  3. Establishment: If the server recognizes the name and has available resources, it sends a "Positive Session Response." At this point, the TCP connection is fully leveraged for NetBIOS data.
  4. Data Transfer: Data is exchanged in "Session Messages." These can be up to 131,071 bytes in size. In the context of file sharing, these messages carry the SMB commands to read, write, or list directories.
  5. Hang Up: Once the communication is finished, either party can gracefully terminate the session.

In our practical testing with network sniffing tools like Wireshark, Port 139 traffic is easily identifiable by the NetBIOS Session Service header that precedes the SMB data. This header specifies the message type and length, providing a wrapper for the actual file-sharing commands.

Major Security Vulnerabilities Associated with Port 139

Port 139 is frequently cited in security audits as a high-risk entry point. Its design flaws and the vulnerabilities in the version of SMB it usually carries (SMBv1) have led to some of the most damaging cyberattacks in history.

Information Leakage and Null Sessions

One of the most persistent issues with Port 139 is the "Null Session" vulnerability. Historically, Windows allowed unauthenticated users to establish a session with a server (using a blank username and password) to enumerate system information. An attacker could use this to harvest:

  • User account names.
  • Share names and permissions.
  • System security policies.
  • Active service lists.

While modern Windows versions have mitigated this by disabling null sessions by default, many misconfigured legacy servers remain vulnerable.

The WannaCry Outbreak and EternalBlue

The most infamous incident involving Port 139 (and its partner Port 445) occurred in May 2017 with the WannaCry ransomware. The attack exploited a vulnerability known as EternalBlue (CVE-2017-0144), which was a flaw in the way the SMBv1 protocol handled certain specially crafted packets.

WannaCry was a "wormable" threat, meaning it could spread automatically from one computer to another without any human interaction. If a single machine with Port 139 or 445 open was infected, the ransomware would scan the local network and the internet for other systems with those ports exposed. Once a target was found, it used the EternalBlue exploit to gain kernel-level access and encrypt the victim's files.

The impact was catastrophic, particularly for the UK's National Health Service (NHS). Thousands of computers, including those controlling MRI scanners and blood-storage refrigerators, were locked, forcing hospitals to divert ambulances and cancel thousands of appointments. The financial damage globally was estimated in the billions of dollars.

Denial of Service (WinNuke)

In the late 1990s, a simple exploit called "WinNuke" plagued Port 139. By sending a string of "Out of Band" (OOB) data to the port, an attacker could cause a Windows 95 or NT machine to crash instantly, resulting in the dreaded Blue Screen of Death (BSOD). While this is no longer a threat to modern systems, it illustrates the historical fragility of the Port 139 implementation.

Detecting and Troubleshooting Port 139

For IT professionals, knowing how to inspect the status of Port 139 is essential for both troubleshooting and security hardening.

Using the NBTSTAT Command

The nbtstat utility is a built-in Windows command-line tool designed specifically for checking NetBIOS over TCP/IP statistics. To see the NetBIOS name table of a remote machine and verify if it is listening on Port 139, you can use: