Port 139 (NetBIOS Session (SMB over NetBIOS))
Older transport for SMB file sharing.
- Transport
- TCP
- Internet exposure
- Never expose
Should not be reachable from the internet.
Security notes
- Carries the same risks as SMB on 445.
- Should be blocked at the internet edge.
When it shows up in your logs
Treat like SMB on 445: inbound from the internet is scanning, internal spread can be lateral movement.