Port 137 (NetBIOS Name Service): Uses and Security

What uses port 137

NetBIOS name service lets Windows machines find each other by computer name through local broadcasts, from the days before DNS was everywhere. Attackers on the same network can answer these broadcasts to capture password hashes (NBT-NS poisoning), which is a good reason to turn NetBIOS off where it isn’t needed.

Should port 137 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

Check what is listening on port 137

Linux

sudo ss -lunp 'sport = :137'

macOS

sudo lsof -nP -iUDP:137

Windows (PowerShell)

Get-NetUDPEndpoint -LocalPort 137
netstat -ano | findstr :137

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Allow port 137 from trusted networks only

The examples allow 137 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

Ubuntu / Debian (ufw)

sudo ufw allow from 10.0.0.0/8 to any port 137 proto udp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 137 proto udp

RHEL / Fedora / Rocky (firewalld)

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="137" protocol="udp" accept'
sudo firewall-cmd --reload

Windows (PowerShell, as administrator)

New-NetFirewallRule -DisplayName "NetBIOS Name Service 137/UDP" -Direction Inbound -Protocol UDP -LocalPort 137 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 137 from another machine

macOS / Linux

nc -zvu example.com 137   # UDP has no handshake, so "open" isn't conclusive

Related ports

Port 139 (NetBIOS Session): used by NetBIOS session service, the legacy transport for Windows file sharing.
Port 445 (SMB): used by SMB for Windows file and printer sharing.
Port 5353 (mDNS): used by multicast DNS for discovering devices on a local network.

More network services ports

53 (DNS) , 67 (DHCP server) , 68 (DHCP client) , 88 (Kerberos) , 123 (NTP) , 135 (Microsoft RPC) , 179 (BGP) , 389 (LDAP) . See all ports in the port lookup.

Sources

IANA port registry: 137

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 137 used for?

Port 137 is used by NetBIOS name service for legacy Windows name resolution on local networks. NetBIOS name service lets Windows machines find each other by computer name through local broadcasts, from the days before DNS was everywhere. Attackers on the same network can answer these broadcasts to capture password hashes (NBT-NS poisoning), which is a good reason to turn NetBIOS off where it isn’t needed.

Is it safe to open port 137?

Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.

How do I check if port 137 is open?

On the server, list listening sockets with "sudo ss -lunp 'sport = :137'" on Linux or "sudo lsof -nP -i :137" on macOS. From another machine, UDP has no handshake, so a port scan can’t reliably tell whether it is open; test with a real client for the service instead.