Port 139 carries SMB over NetBIOS, a legacy approach that was used for older LAN file sharing. Port 445 carries SMB directly over TCP/IP, which simplifies connectivity and is the modern default in many Windows environments. From a security standpoint, both matter, but 445 is especially important because it is commonly targeted on exposed networks.
Why the Transport Choice Matters for SMB
SMB is the same file-sharing protocol family in both cases, but the transport changes how clients discover, negotiate, and reach the service. port 139 reflects the older NetBIOS session layer path, while port 445 is the direct TCP path that removed the NetBIOS dependency. The practical difference is not just historical, because the transport affects compatibility, exposure, and how security teams monitor the service.
NetBIOS over TCP/IP was designed to bridge name resolution and session setup for legacy Windows networks. SMB on 445 bypasses that wrapper and speaks more directly to the host over TCP, which is why modern Windows environments usually prefer it. That simplification improves interoperability, but it also means that exposed 445 services are a common network-facing target and deserve explicit control.
One useful way to think about the split is that 139 is the legacy compatibility path and 445 is the modern service path. In mixed environments, both can exist for the same host, which can confuse inventory, firewall policy, and exposure review if teams assume only one file-sharing port matters.
What Changes Operationally Between Port 139 and Port 445
Port 139 usually implies NetBIOS session services are in play, so the connection model is older and more layered. Port 445 removes that extra layer and lets SMB run directly over TCP/IP, which reduces complexity and is the basis for most contemporary Windows file sharing. That difference matters for troubleshooting, because failures on 139 can involve NetBIOS name resolution or legacy session handling, while 445 issues are more often TCP reachability, authentication, or SMB policy problems.
From a network design standpoint, 445 is the cleaner default because it works without the extra NetBIOS service stack. From a legacy-support standpoint, 139 may still appear where older systems, older clients, or compatibility settings remain in use. Practitioners should treat the coexistence of both ports as a signal to check whether legacy dependencies are still required or whether they are simply lingering exposure.
The protocol difference also affects boundary control. If a host only needs modern SMB, allowing 445 and suppressing 139 reduces the number of reachable entry points. If legacy interoperability is still needed, that exception should be explicit and time-bound rather than assumed as a permanent default.
Exposure, Scanning, and Exposure Review for SMB Ports
The main security difference is not that one port is inherently safe and the other is not, but that 445 is far more commonly scanned and attacked on exposed networks. SMB on 445 is often used for lateral movement, enumeration, and credential-based access attempts when it is reachable beyond a trusted boundary. Port 139 is less common in modern deployments, but it still broadens the attack surface when left open unnecessarily.
Because both ports can carry file-sharing traffic, defenders should review firewall rules, asset inventory, and listening services together. A host advertising both 139 and 445 may be running legacy compatibility features that were never removed after migration. That creates a policy gap if security reviews only ask whether “SMB is enabled” instead of checking which transport paths are actually open.
For broader exposure management, the right question is whether SMB must be reachable at all from a given network segment. If the answer is yes, the next question is which transport is required for business function and whether authentication, segmentation, and logging are aligned to that choice.
Risk and Threat Considerations
Exposed SMB increases attack surface because it provides a high-value, authentication-bearing service that is frequently probed by attackers. Port 445 is especially important because it is widely reachable on internal networks and is a common focus for scanning, brute-force attempts, lateral movement, and worm-like propagation when segmentation is weak.
Failure mechanism: Legacy 139 support can persist unnoticed, while 445 remains reachable across trust boundaries, creating multiple paths into the same file-sharing service and increasing the chance of misconfiguration or abuse.
Impact: Unnecessary exposure can lead to unauthorized access attempts, credential abuse, service enumeration, and faster spread after an endpoint compromise, especially where SMB shares or administrative access are too broadly permitted.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | SMB exposure over 445 is a network defense concern. |
| Recommendation — Restrict SMB reachability and monitor for unexpected port 445 exposure. | ||
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Port 139 and 445 reachability depends on boundary filtering. |
| AC-4 — Information Flow Enforcement | SMB transport choice affects how file-sharing flows are permitted. | |
| Recommendation — Enforce boundary filtering for SMB and block unnecessary legacy ports. Apply information flow rules to limit SMB paths by trust boundary. | ||
| ISO/IEC 27001:2022 | A.8.20 — Network security | SMB port exposure is a network security control issue. |
| Recommendation — Control SMB exposure through network security rules and segmentation. | ||
Practitioner Guidance
What to verify: Confirm which hosts actually need SMB, which transport they require, and whether 139 exists only for legacy compatibility. If a system only needs modern Windows file sharing, disable or block 139 and keep 445 constrained to the smallest necessary trust boundary.
Common mistake: Teams often focus on whether SMB is “on” and miss the difference between an internal file server and an externally reachable SMB listener. The latter is the materially higher-risk condition, and it should trigger tighter segmentation, access review, and logging.
Practitioner takeaway: Treat 139 as a legacy compatibility path and 445 as the modern SMB exposure that needs deliberate network control, because the security decision is driven less by the protocol name than by where the service is reachable.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
