Skip to main content
IMMUNITYSEC

Port 138: NetBIOS Datagram Service

UDP port 138 is the NetBIOS Datagram Service defined in RFC 1002. It carries connectionless NetBIOS messages, including traffic for the legacy Windows Computer Browser service. Microsoft notes that the browser service is no longer required when only Windows Vista and later versions are in use.

138
UDP

Port Details

Port
138
Transport
UDP
Service
NetBIOS-DGM
IANA service name
netbios-dgm
Range
System port (0-1023)
Related ports
137139

Security Exposure

Port 138 is mainly a sign of legacy NetBIOS networking that modern Windows file sharing no longer needs. Microsoft states that SMB2 and later shares do not use ports 137 to 139, and Windows 11 version 24H2 and Windows Server 2025 no longer open them in built-in firewall rules. Leaving NetBIOS enabled keeps related name and session services available for credential poisoning (MITRE ATT&CK T1557.001).

Hardening

  • +Block UDP 138 at network perimeters and between segments with no legacy NetBIOS need.
  • +Disable NetBIOS over TCP/IP on hosts that do not need it.
  • +Retire the Computer Browser service and systems that still depend on SMB1.

Monitoring

Inventory hosts that send or receive UDP 138 traffic to find remaining legacy NetBIOS systems, and track that list as they are retired.

Tools for Auditing and Monitoring NetBIOS-DGM

Zeek

Open Source
Network Monitoring Tools

Network security monitoring framework that translates raw packet traffic into structured transaction logs and network events.

LicenseBSD-3-Clause
PlatformLinux, FreeBSD, macOS, OpenBSD

Wireshark

Open Source
Network Monitoring Tools

Network packet analyzer and protocol inspection tool for capturing live traffic and debugging network communications in detail.

LicenseGPL-2.0-or-later
PlatformWindows, macOS, Linux, BSD

Nmap

Free / Commercial
Penetration Testing Tools

Network discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.

LicenseNPSL-0.95 (Nmap Public Source License, not OSI-approved)
PlatformLinux, macOS, Windows

Related Tool Categories

Network Monitoring Tools→

Packet capture tools, protocol analyzers, and network security monitors for traffic visibility.

Network Security Tools→

Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.

Frequently Asked Questions

What uses UDP port 138?→

The NetBIOS Datagram Service. Microsoft lists UDP 138 for the Computer Browser service and for the Server service that provides file and printer sharing.

Do modern Windows versions need port 138?→

Generally no. Microsoft states that SMB2 and later shares do not use NetBIOS ports 137 to 139, and the browser service is not required when only Windows Vista and later are in use.

Sources

Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 138 is not guaranteed to be NetBIOS-DGM. Exploited-in-the-wild data from the CISA KEV catalog (CC0).