{
  "port": 139,
  "protocol": "tcp",
  "service": "NetBIOS Session Service",
  "oneLiner": "SMB over NetBIOS — the pre-2000 file sharing path that still lingers next to 445.",
  "whatItIs": "Port 139 carries the NetBIOS Session Service from RFC 1001/1002, and on top of it rides SMB for Windows file and printer sharing. Since Windows 2000, SMB prefers direct hosting on TCP 445 and only falls back to 139 for older peers, so a host with 139 open is usually supporting legacy clients or running a Samba server with NetBIOS enabled. It shows up constantly on NAS boxes, print servers, and unpatched Windows machines. Together with 137/138 UDP it also leaks workgroup and machine names to anyone who asks.",
  "exposure": {
    "verdict": "never",
    "note": "File sharing and name-service leakage on a public IP; this is the classic \"my NAS is on the internet\" finding. Keep SMB on the LAN or a VPN."
  },
  "checkCommand": "sudo lsof -nP -iTCP:139 -sTCP:LISTEN",
  "links": [
    {
      "title": "RFC 1001 — NetBIOS over TCP/UDP: Concepts and Methods",
      "url": "https://www.rfc-editor.org/rfc/rfc1001.html",
      "kind": "spec"
    },
    {
      "title": "RFC 1002 — NetBIOS over TCP/UDP: Detailed Specifications",
      "url": "https://www.rfc-editor.org/rfc/rfc1002.html",
      "kind": "spec"
    },
    {
      "title": "Samba source repository",
      "url": "https://github.com/samba-team/samba",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}