UDP Dangerous Other

Port 138 (NetBIOS Datagram)

Learn about port 138 (NetBIOS Datagram) - security risks, vulnerabilities, and common uses. Find devices with port 138 open.

Quick Info

Port Number

138

Protocol

UDP

Service

NetBIOS Datagram

IANA Name

NetBIOS Datagram

Service Description

UDP port 138, commonly known as NetBIOS Datagram Service, is a crucial component of the NetBIOS over TCP/IP (NetBT) protocol suite. It's primarily used for connectionless data transfer, specifically for NetBIOS name resolution and datagram distribution. This service allows computers on a network to locate each other by NetBIOS names rather than IP addresses. The datagram service, unlike the NetBIOS Session Service (port 139), doesn't establish a persistent connection. Instead, it relies on UDP's connectionless nature to send and receive packets. Operationally, when a computer needs to resolve a NetBIOS name, it broadcasts a name query on port 138. Any machine on the network that owns that name responds directly to the requesting computer, providing its IP address. Similarly, NetBIOS datagrams can be used for sending small amounts of data to multiple recipients simultaneously, which is useful for announcements or status updates within a local network. The protocol relies on NetBIOS frame structures encapsulated within UDP packets for transmission. The history of NetBIOS dates back to the early days of networking, predating TCP/IP's widespread adoption. However, to leverage the advantages of TCP/IP networks, NetBIOS was adapted to run over TCP/IP, creating NetBT. Port 138 is a key element in maintaining backward compatibility and facilitating name resolution within a NetBT environment.

At a technical level, the NetBIOS Datagram Service operates by encapsulating NetBIOS messages within UDP packets. These messages can include name queries, responses, and data packets. When a host needs to send a NetBIOS datagram, it constructs a UDP packet with the destination port set to 138. The packet's payload contains the NetBIOS message, which includes information such as the source and destination NetBIOS names, the message type, and the data being transmitted. Because UDP is a connectionless protocol, there's no guarantee of delivery or order of packets. The NetBIOS layer is responsible for handling any necessary retransmissions or error recovery. Name resolution requests, for example, are often broadcast to the local network segment, allowing any machine with the corresponding NetBIOS name to respond. This broadcast nature, while efficient for small networks, can lead to significant network congestion and security vulnerabilities in larger or internet-connected environments. The protocol specifies various message types and formats to ensure interoperability between different NetBIOS implementations.

## Firewall Recommendations

Blocking UDP port 138 at the network perimeter is highly recommended, especially if NetBIOS is not explicitly required for external communication. Within the internal network, restricting access to port 138 to only those devices that legitimately require it is a good practice. Consider disabling NetBIOS over TCP/IP entirely if it's not needed, opting for more secure protocols like DNS for name resolution and SMB over direct TCP/IP (port 445) for file sharing. If NetBIOS is necessary, implement strong network segmentation to isolate NetBIOS traffic to trusted internal networks. Monitor network traffic for suspicious activity on port 138, such as excessive broadcast traffic or connections from unauthorized sources. Regularly patch and update systems to address known vulnerabilities in NetBIOS implementations. Utilize intrusion detection and prevention systems (IDS/IPS) to detect and block malicious traffic targeting port 138. Ensure that firewalls are configured to block both inbound and outbound traffic on ports 137-139 and 445 to prevent NetBIOS and SMB-related attacks.

Security Information

NetBIOS Datagram Service (UDP port 138) presents several security risks, largely due to its broadcast nature and lack of built-in authentication mechanisms. Because name resolution requests are broadcast to the entire network, attackers can easily intercept these requests to gather sensitive information about network resources and connected devices. This information can then be used to launch targeted attacks, such as man-in-the-middle attacks or denial-of-service attacks. Additionally, the lack of strong authentication makes it possible for attackers to impersonate legitimate network devices or services, potentially redirecting traffic or injecting malicious data into the network. The protocol's reliance on NetBIOS names, which are often predictable, further exacerbates these risks. Attackers can exploit vulnerabilities in NetBIOS implementations to execute arbitrary code on vulnerable systems, gaining complete control over the compromised machine. The prevalence of NetBIOS in older systems and legacy applications also means that many networks may still be vulnerable, even if they have migrated to more modern protocols. Attackers often target port 138 because it provides a convenient entry point for reconnaissance and exploitation of NetBIOS-related vulnerabilities, allowing them to map out the network, identify vulnerable systems, and launch attacks with relative ease.

Known Vulnerabilities

CVE	Name	Severity	Description
CVE-2017-0143	MS17-010: Security Update for Microsoft Windows SMB Server	Critical	This vulnerability, exploited by WannaCry and other ransomware, allows remote code execution due to a flaw in how SMBv1 handles specially crafted packets. While not directly a NetBIOS vulnerability, it often propagates through NetBIOS networks.
CVE-2017-0144	MS17-010: Security Update for Microsoft Windows SMB Server	Critical	Similar to CVE-2017-0143, this vulnerability allows remote code execution via SMBv1.
CVE-2020-0796	SMBGhost (CVE-2020-0796)	Critical	A remote code execution vulnerability exists in Microsoft Windows SMBv3 protocol. An attacker who successfully exploited this vulnerability could gain the ability to execute code on the target server or client.
CVE-2008-3431	Samba trans2open heap-based buffer overflow	High	A heap-based buffer overflow vulnerability exists in the trans2open function in Samba, potentially leading to remote code execution.
CVE-2015-0240	Samba dcerpc_netlogon.c use-after-free vulnerability	High	A use-after-free vulnerability exists in Samba due to improper handling of DCERPC requests, potentially leading to remote code execution.