NetSecWallFree trialDownload
Ports 137 and 138 · UDP

Ports 137 and 138: NetBIOS name and datagram service

NetBIOS over TCP/IP: the 1980s way Windows PCs found each other by name on a local network (137) and broadcast small messages (138).

Protocol
UDP
On Windows
System (PID 4, NetBIOS over TCP/IP)
Risk if open to the internet
High

Seeing it on your PC

System (PID 4) listening on 137 and 138 is normal on a Windows network adapter with NetBIOS enabled.

Should you block it?

Keep it off the internet. On a network with no very old devices you can turn NetBIOS over TCP/IP off in the adapter's IPv4 settings, under Advanced, WINS. Attackers on the same network can answer NetBIOS name queries to capture sign-in hashes.

Check it on your PC

Run this in PowerShell to see what is using port 137 right now, and which program owns it:

Get-NetUDPEndpoint -LocalPort 137 -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}

No output means nothing is using the port at the moment. For every connection at once, paste netstat -ano into the netstat explainer.

Block it in Windows Firewall

In PowerShell run as administrator, this stops other computers from connecting to this port on your PC. It does not stop your own programs connecting out.

New-NetFirewallRule -DisplayName "Block inbound UDP 137,138" -Direction Inbound -Protocol UDP -LocalPort 137,138 -Action Block

Undo it with Remove-NetFirewallRule -DisplayName "Block inbound …", using the same name. If you depend on the service on your local network, this rule stops that too.