Port 139

Ok I noticed I have port 139 open again. I was doing port scans on myself because my internet has been real slow lately. Besides I figured well this is a good time to check my own security. I usualy do pretty often. I dont know that much about it, but I look for oddities.

Now a year or so ago I always had port 139 open, and then this summer I reformated my hard drive, and it seemed port 139 wasnt open. I havent noticed it open untill today since then. But exactly what is port 139 used for, and why would it be open?

I'm running the normal applications that I was just a week ago and I didnt have that port open. So whats going on here?

Thanks for any help.

139 is NETBIOS Session Service. It is best to have this port disabled unless you are using the old netbui protocol on your network. It is a well known security hole.

Close Netbios to 0.0.0.0, open to local routes if you *really* want it/need it. Too many exploits, way, way, WAY too little use (read: none) over the internet.

from personal experience,you can disable file sharing and still use netbios to have some fun http://www.megasecurity.org/Info/filesharing.txt

Ok. That is an interesting tutorial type thing you posted, but could you breifly describe the steps of opening that port, and closing it?

How is it opened. Why would it be opened when I havent opened it(knowingly).

How do you close it?

Could you specify exactly what OS you are running? like win 9X or NT.
Sometimes ppl. have Netbios enabled without knowing or from setting up a home network using Netbeui.

Just a little clarification people:

port 139 (netbios-ss) has nothing* to do with NETBEUI:
port 139 has to do with NetBIOS over TCP/IP... the difference is that netbeui is a network/transport layer for NetBIOS (which in turn carries SMB) just as TCP/IP is (however NetBEUI is non-routable)

So if you want to disable (might not close it completly but it wont respond) port 139, either uncheck "allow netbios over tcp/ip" in the network card's properties or remove "file and printer sharing"

Anyways, I suggest checking out this site:
http://cable-dsl.home.att.net/netbios.htm

Ammo

*While netbios has nothing to do with nebeui, netbeui has to do with netbios as it is automaticly binded to it... Sort of like a square is a rectangle but a rectangle isn't a square ;)

Port 139 can be open if a share access is disabled too, and this is not metter for security...it is dangers if you have netbio enabled, you just check this:

1. type winipcfg in start, run, hit enter and you see your IP

2. In Ms-Dos type nbtstat -a IP

3. If you see in < > number 20 like <20> that means your share acces is enabled and you must properly configure you comp in control panel..
Thats all...

Visit www.xatrix.org if you want to be informed