Port 137 (NetBIOS Name Service)
Legacy Windows name resolution, alongside 138 (datagram) and 139 (session).
- Transport
- UDP
- Internet exposure
- Never expose
Should not be reachable from the internet.
Security notes
- NetBIOS and LLMNR name poisoning (e.g. with Responder) captures NetNTLM hashes on local networks.
- Disable NetBIOS over TCP/IP where it is not needed.
When it shows up in your logs
Name queries answered by an unexpected host can indicate poisoning on the local network.