Skip to main content
Default Ports: 137 (Name Service), 138 (Datagram Service), 139 (Session Service) NetBIOS predates modern TCP/IP networking and was originally how Windows machines found each other and shared resources on a local network before DNS and SMB over TCP took over that job directly. It’s largely legacy today, but it’s rarely fully disabled, which makes it a quiet but reliable source of hostnames, domain info, and occasionally credentials through its name resolution weaknesses.

Name Service (137)

Resolves NetBIOS names to IP addresses on the local network, the NetBIOS equivalent of DNS. This is what most enumeration tools actually query.

Session Service (139)

Carries the actual SMB session once a name has been resolved. Functionally the predecessor to SMB running directly over port 445.
NetBIOS and SMB are closely tied together historically, port 139 exists specifically to carry SMB traffic over NetBIOS sessions. Deeper SMB share and authentication attacks belong on the SMB page; this page focuses on NetBIOS name resolution and enumeration specifically.

​
Why NetBIOS Still Matters

Modern Windows networks run SMB directly over TCP port 445 and don’t strictly need NetBIOS at all, but the services are still enabled by default on most Windows installs for backward compatibility. That leftover functionality is what makes it worth checking:
  • It often responds even when other enumeration paths are locked down or rate-limited, since it predates most modern logging and alerting.
  • Name queries can reveal a hostname, workgroup, or domain name without needing any credentials at all.
  • The underlying name resolution protocol (NBT-NS) is broadcast-based and trivially spoofable, which is the basis for a well-known credential-capturing attack covered further down.

​
NetBIOS Name Suffixes

Every NetBIOS name is actually a 16-character field, padded if necessary, where the last byte (the suffix) indicates what kind of resource the name represents. Reading these suffixes is how you tell a workstation from a domain controller from a browser service in raw NBT-NS output.
SuffixServiceDescription
00Workstation ServiceRegistered by every machine, basic presence on the network
03Messenger ServiceUsed for the (long since removed) net send service
20File Server ServiceIndicates the host is sharing files, i.e. running SMB
1BDomain Master BrowserIdentifies the domain controller holding the master browse list
1CDomain ControllersGroup name registered by domain controllers
1EBrowser Election ServiceUsed in master browser elections
Seeing suffix 1C in a scan’s output is a fast way to spot domain controllers on a subnet without needing to query LDAP or check anything else first.

​
Enumeration

A handful of lightweight, purpose-built tools cover NetBIOS enumeration, all of which work without any credentials since name resolution itself requires none.
nbtscan output includes the resolved NetBIOS name, the workgroup or domain, and often the MAC address, useful for quickly mapping a subnet before doing anything else.
The -A flag is the one worth remembering: it returns the complete suffix table described above for a single host, rather than just the primary name.
Nmap’s nbstat script does the same node status query but integrates into a broader scan, convenient when NetBIOS enumeration is just one part of a larger sweep.
enum4linux pulls NetBIOS information alongside its broader SMB enumeration, worth running here too since the two protocols are so closely linked, it’s often the single most complete command for a quick first look at a Windows host.

​
NBT-NS Poisoning

This is an active, intrusive attack that intercepts live authentication traffic on the network, not passive enumeration. Confirm scope explicitly covers this before running it.
NBT-NS, the protocol behind NetBIOS name resolution, falls back to a broadcast request whenever DNS resolution fails, essentially asking the entire local network “does anyone know this name?” There’s no authentication on these responses, so a tool sitting on the network can simply answer first and claim to be whatever host was being looked for. When a user’s machine tries this (often triggered by something as simple as a mistyped share path), it ends up authenticating straight to the attacker instead, handing over an NTLM hash in the process.
This is the same attack and the same tool covered on the SMB page, since NBT-NS poisoning and SMB credential capture are really one continuous attack chain, NetBIOS is just the resolution weakness that makes it possible in the first place.

​
Quick Reference Tools

Hackviser: NetBIOS

Quick-reference pentesting guide for the NetBIOS service.

HackTricks: NetBIOS

Deeper breakdown of NetBIOS enumeration and related attacks.
NetBIOS enumeration itself is passive and low-risk, but NBT-NS poisoning intercepts live traffic. Treat it with the same caution as any other active credential-capture technique.