What is NetBIOS?
Imagine an internal office directory that lists departments and what they do. Finding Finance tells you where to start. Entering the office and reading its documents each require permission.
NetBIOS (Network Basic Input/Output System) began as an interface that lets local-network programs use names and exchange data. NetBIOS over TCP/IP, often called NBT or NetBT, carries those functions over TCP/IP networks.
NetBIOS enumeration queries name and status information. It helps inventory older systems, identify service clues, and check who can obtain that information. NetBIOS concepts
What do ports 137, 138, and 139 do?
• Name service, port 137: registers and queries names, commonly over UDP, with TCP also defined. • Datagram service, UDP 138: sends messages without first establishing a session. • Session service, TCP 139: establishes a connection for ongoing data exchange. Traditional SMB can use it.
Connect this to the previous lesson: directly hosted SMB uses TCP 445 and can work without NetBIOS. If a NetBIOS query gets no reply, check SMB availability separately. Microsoft: NetBIOS and directly hosted SMB
Keep separate results for name queries and SMB file access.
- 137 | Names
Commonly UDP; TCP is also defined. Name registration and queries.
- 138 | Datagrams
UDP messages without first establishing a session.
- 139 | Sessions
TCP sessions; traditional SMB can use this connection.
- 445 | Direct SMB
TCP, without requiring NetBIOS. Check separately.
How are names found?
NetBIOS name resolution maps names to network addresses. Depending on configuration, a computer may broadcast on the local network or query a central name server. Windows WINS provides this kind of name service.
NetBIOS and DNS use different name systems. A computer may have similar names in both, but verify the queries and records separately.
Windows name displays often include a hexadecimal suffix, such as <00> or <20>, that describes the name’s purpose. Read three fields together: • Name, such as LAB-FS. • Suffix, such as <20>. • Type, such as UNIQUE or GROUP.
UNIQUE identifies a unique name; GROUP identifies a group name. A NetBIOS group name is distinct from a group used to grant file permissions. Microsoft names and suffixes
Read a made-up name table
This is a synthetic authorized-lab example. We did not run a query.
On Windows, nbtstat can display NetBIOS name tables. Within an approved practice environment, enter this in Command Prompt:
nbtstat /A 192.0.2.10
/A queries the remote name table by IP address. Lowercase /a queries by remote name; letter case matters. 192.0.2.10 is a documentation address. Replace it with the agreed lab host when practicing. nbtstat manual · Documentation addresses
Assume the reply contains these three entries: • LAB-FS <00> UNIQUE: a computer-name clue associated with the Workstation service. • LAB-FS <20> UNIQUE: a name registered by the Server service, useful as a clue for checking file sharing. • LABGROUP <00> GROUP: a machine-group name clue. Confirm the actual workgroup or domain configuration with administrative records. Microsoft suffix definitions
You have obtained names and clues about their purpose. Check share names, sign-in requirements, and reads or writes to specific files separately, using the SMB lesson within the agreed test boundaries.
Also distinguish data sources: nbtstat /n shows the local name table; /c shows the local name cache. Record these separately from a fresh reply to a remote query.
How should you record the result?
For a timeout, record that no reply arrived during the waiting period. Possible causes include a disabled service, firewall filtering, the network path, or the target’s state. Use additional evidence to locate the cause.
For the example table, a useful record says: “From the agreed network location, the query to the specified lab host returned LAB-FS <00>, LAB-FS <20>, and the LABGROUP group-name entry. Share and file operations await separate checks.”
Save the time, source network location, target, tool and arguments, and full response. Compare the name table with the asset inventory and service settings. Product versions, vulnerabilities, and actual access permissions each need their own evidence.
Keep every step within the agreed authorization. The name table itself describes names.
- Name table
Save names, suffixes, types, and the full reply.
- Service check
Confirm the SMB connection and protocol response.
- Identity and share
Record the identity, share name, and conditions.
- Specific file
Record the full path, action, and result.
Protect the service according to its purpose
First identify older devices or applications that still depend on NetBIOS. Then plan changes: • Systems that need it: limit the networks and sources that can connect. • Systems without dependencies: test compatibility before disabling NetBIOS over TCP/IP. • Boundary firewalls: expose name services and file sharing only to the intended networks. • Unusual queries: review them alongside asset settings and logs.
After NetBIOS is disabled, directly hosted SMB on TCP 445 may still work. Continue managing its network access, authentication, share permissions, and file permissions separately.
One small check
You find LAB-FS <20> UNIQUE. A colleague says, “That means we can already read its shared files.”
In two or three sentences, what clue do you have? What checks would establish whether you can read a particular file?
This check awaits your answer. The site does not submit answers or update understanding. Q&A awaits actual questions and discussion. Next is M04-06 SMTP enumeration.
Concept Q&A
Pending: related questions will be edited into anonymous teaching notes when available.