NetBIOS (Network Basic Input/Output System) #

At a Glance #

NetBIOS is a non-routable service that allows applications and computers to communicate over a local area network (LAN).

As an API, NetBIOS relies on network protocols to communicate. In modern networks, NetBIOS runs over TCP/IP via the NetBIOS over TCP/IP protocol or NBT.¹

NetBIOS provides three distinct services:

• Name Service (NetBIOS-NS) for name registration and resolution.
• Datagram Distribution Service (NetBIOS-DGM) for connectionless communication.
• Session Service (NetBIOS-SSN) for connection-oriented communication.

Name Service #

On a NetBIOS network, applications locate and identify each other through their NetBIOS names. NetBIOS Name Service serves much the same purpose as DNS does: translate human-readable names to IP addresses.

NetBIOS names are 16 octets long, however, Microsoft limits the hostname to 15 characters and reserves the 16th character as a NetBIOS Suffix. This suffix, aka NetBIOS End Character (endchar), describes the service or name record type.² See NetBIOS Suffixes.

In NBT, NetBIOS-NS runs on UDP port 137.

Datagram Distribution Service #

The Datagram service is an unreliable, non-sequenced, connectionless service.

Datagrams may be sent to a specific name or explicitly broadcast. Usually used to broadcast names and register services.³

In NBT, NetBIOS-DGM runs on UDP port 138.

Session Service #

The Session service offers a reliable message exchange, conducted between a pair of NetBIOS applications. Sessions are full-duplex, sequenced, and reliable.³

The service facilitates authentication and provides access to shared resources, such as files and printers. It is where NULL Sessions are established.

In NBT, NetBIOS-DGM runs on UDP port 139.

Enumeration #

nmblookup ⁴ #

nmblookup -A 10.0.0.3

nbtscan ⁵ #

nbtscan 10.0.0.3

NetBIOS Exploits Search #

Refer to Exploits Search

NetBIOS Suffixes ⁶ #

Further Reading #

• Windows File Sharing: Facing the Mystery by Daniel Miessler