18

I never really understood NetBIOS. I didn't understand the Wikipedia article about it. I searched YouTube but couldn't find a video explaining what NetBIOS is.

What does NetBIOS do? I'm using a Windows XP machine and ports 137, 138 seem to be open on my machine. Should I close them? Or does my Windows need them open for some purpose? If not, why would I need NetBIOS?

Improve this question
3
  • 2
    Okay, I've purged the comments here. claws, please understand that questions should be rather specific, and not ask to explain a topic in its entirety, especially when everything can be looked up. You'd need to tell us what exactly you didn't understand while reading the Wikipedia article, or where you require additional information.
    – slhck
    Aug 28, 2013 at 14:32
  • @slhck: I've edited my question. Is it specific enough?
    – claws
    Aug 28, 2013 at 14:42
  • serverfault.com/questions/88064/…
    – claws
    Sep 1, 2013 at 16:10

2 Answers 2

Reset to default
26

From hackerthreads.org:

NetBIOS stands for Network basic input output system and is used in Windows for its file and printer sharing.

From Wikipedia:

It provides services related to the session layer of the OSI model allowing applications on separate computers to communicate over a local area network.

From TechNet:

A Session layer programming interface. NetBIOS is a standard application programming interface (API) at the Session layer of the Open Systems Interconnect (OSI) reference model so that user applications can utilize the services of installed network protocol stacks. An application that uses the NetBIOS interface API for network communication can be run on any protocol stack that supports a NetBIOS interface.`

A session management and data transport protocol NetBIOS is also a protocol that functions at the Session and Transport layers and that provides commands and support for the following services:

  • Network name registration and verification.
  • Session establishment and termination.
  • Reliable connection-oriented session data transfer.
  • Unreliable connectionless datagram data transfer.
  • Protocol and adapter monitoring and management.

NetBIOS over TCP/IP (NetBT) sends the NetBIOS protocol over the Transmission Control Protocol (TCP) or the User Datagram Protocol (UDP).

From another TechNet article, NetBIOS implementation over TCP/IP?:

The Windows 2000 implementation of NetBIOS over TCP/IP is referred to as NetBT. NetBT uses the following TCP and UDP ports:

  • UDP port 137 (name services)
  • UDP port 138 (datagram services)

  • TCP port 139 (session services)

    NetBIOS over TCP/IP is specified by RFC 1001 and RFC 1002. The Netbt.sys driver is a kernel -mode component that supports the TDI interface. Services such as workstation and server use the TDI interface directly, while traditional NetBIOS applications have their calls mapped to TDI calls through the Netbios.sys driver. Using TDI to make calls to NetBT is a more difficult programming task, but can provide higher performance and freedom from historical NetBIOS limitations.

The architecture would be like this:

You can try a hack on NetBIOS over SSN – NetBIOS usage in Linux:

C:\>nbtstat.exe -a morpheus

<Local Adapter Name>:
Node IpAddress: [<local IP address>] Scope Id: []
NetBIOS Remote Machine Name Table
Name    Type    Status
MORPHEUS <00>   UNIQUE  Registered
MATRIX <00>     GROUP   Registered
MORPHEUS <20>   UNIQUE  Registered

MAC Address = <Remote MAC address>

C:\>nbtstat.exe -c

<Local Adapter Name>:
Node IpAddress: [<local IP address>] Scope Id: []

How does NetBT behave over DNS/internet enhancements:

Improve this answer
6
  • +1 Your first sentence itself did the job. Thanks a lot :)
    – claws
    Aug 28, 2013 at 14:29
  • 2
    @VVignesh4303: When I open any folder properties and share it over the network and access it using path like \\10.12.123.134, is windows using netbios in the background? If I don't have anything to share then can I disable netbios service (listening on port 37.38)?
    – claws
    Aug 28, 2013 at 14:32
  • @claws yes its running in background ,check for netbt.sys service on operating system
    – BlueBerry - Vignesh4303
    Aug 28, 2013 at 14:52
  • 1
    I edited your post to include proper sources and posts. Please always do this when citing other websites or sources. Ideally you should write answers in your own words though and quote as little as possible. Please also cite the sources of the images.
    – slhck
    Aug 28, 2013 at 16:34
  • For further reading this one helped a bit: serverfault.com/questions/88064/…
    – claws
    Sep 1, 2013 at 16:10
13

I just wanted to add that for versions of Windows from Windows 2000 and onward, all of the legacy NetBIOS functionality from ports 137, 138 and 139 is by default handled by SMB (Server Message Block) over port 445. If the computers on both end of the network connection are Windows 2000 or later, you can safely block ports 137, 138 and 139 as long as port 445 is open

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .