Port 138 UDP: NetBIOS Datagram Service
UDP port 138 is the NetBIOS Datagram Service. It belongs to the older NetBIOS-over-TCP/IP family used by legacy Windows discovery and messaging workflows. Modern SMB can use TCP 445 directly, so do not expose UDP 138 beyond the local or explicitly trusted networks that still require it.
Port 138 at a glance
| Property | Value |
|---|---|
| Transport | UDP |
| Service | NetBIOS Datagram Service |
| Traffic style | Connectionless datagrams; often associated with legacy local-network browsing and name-based Windows workflows |
| Perimeter policy | Block unless a documented, trusted-network requirement exists |
How ports 137, 138, 139 and 445 differ
| Port | Protocol | Role |
|---|---|---|
137 | UDP | NetBIOS Name Service |
138 | UDP | NetBIOS Datagram Service |
139 | TCP | NetBIOS Session Service |
445 | TCP | Direct-hosted SMB without the older NetBIOS transport |
Microsoft notes that SMB 2 and later can use direct TCP/IP on port 445. A network may still show 137–139 because of legacy systems, compatibility settings, older applications or specific DFS/NetBIOS dependencies.
Find and observe UDP 138 safely
UDP has no TCP-style handshake, so a remote scan can be inconclusive. Start on the endpoint:
- Windows PowerShell:
Get-NetUDPEndpoint -LocalPort 138 - Linux:
sudo ss -lunp '( sport = :138 )' - Packet capture display filter:
udp.port == 138
Capture only on networks you are authorised to inspect. Check the source/destination subnets, broadcast behaviour and owning Windows services before deciding whether the traffic is expected.
Security and troubleshooting checklist
- Confirm whether the organisation actually needs NetBIOS over TCP/IP; do not disable it blindly on a legacy production network.
- Keep UDP 138 off internet-facing interfaces and block it at perimeter boundaries.
- If local discovery fails, verify the Windows network profile, local firewall, NetBIOS setting, name resolution and whether the application now expects direct SMB on 445.
- Separate user, server and legacy-device networks so a compatibility requirement does not become a site-wide rule.
- After a change, test the named application workflow—not merely whether a port appears open.
Frequently asked questions
What is UDP port 138 used for?
UDP 138 carries the NetBIOS Datagram Service, an older Windows networking component used by legacy discovery, messaging and some NetBIOS-dependent workflows.
Is port 138 TCP or UDP?
Port 138 is normally UDP. The related NetBIOS Session Service uses TCP 139, while direct-hosted SMB uses TCP 445.
Is NetBIOS port 138 still needed?
It depends on the environment. Modern Windows SMB can use TCP 445 directly, but legacy systems or applications may still depend on NetBIOS. Verify dependencies before disabling it.
Should UDP 138 be exposed to the internet?
No. Block it at the perimeter and permit it only on explicitly trusted internal paths where a verified legacy requirement exists.
Primary sources
- Microsoft: Windows service overview and port requirements
- Microsoft: direct-hosted SMB over TCP/IP
- IANA service-name and port-number registry
Port registrations describe assigned names, not a guarantee about the process actually listening on a device. Confirm the local process and configuration before changing a firewall.
Related guides
Practise the diagnosis, not only the port number
Use an authorised lab to identify the listener, inspect packets and test the firewall path. Attila teaches these troubleshooting habits with networking and security labs in Ahmedabad.