I am learning a legacy system where the security team only opened TCP port 139 between web servers and a file server (both Windows 2008 R2) for file access. I have usually used TCP port 445 for such access. Why would the recommend using port 139 only? Are there benefits from using Port 139 over port 445 or vise versa?
Add a comment
|
1 Answer
This is explained in Q204279.
In short: earlier Windows versions (pre Windows 2000) used "NetBIOS over TCP/IP" (with 137/udp, 137/tcp, 138/udp and 139/tcp) to offer the SMB protocol. Newer versions can skip the NetBIOS part and can communicate directly with other hosts via 445/tcp and NetBIOS can be disabled.
Oh, and as to why anyone would use one or the other: 139/tcp would be used if older Windows clients are in use that don't know about direct SMB. But in general 445/tcp would be preferable, as it's easier to configure just one port as 4 different port/protocol configurations in e.g. a firewall.
-
Just as I was thinking. I appreciate you confirming for me. The strange part is that it seems only TCP 139 is open from web to file server. Using telnet I was unable to connect on 137 or 138. Strange setup.– BrettskiJan 22, 2014 at 3:26
-
1In NetBIOS, port 138 is for UDP, so telnet would not be able to connect to that port. Same for port 137, although Q204279.names 137/tcp also, I've never seen port 137 configured for TCP, only UDP.– ckujauJan 22, 2014 at 3:54
-
Found this PowerShell command to check UDP connection. If returns without error it was able to connect. Use at own risk: (New-Object Net.Sockets.UdpClient).Connect("<remote machine>",<port>)– BrettskiJan 22, 2014 at 19:31
-
Nice, but it returns w/o error for every UDP connection, because of...well, UDP really. One has to watch the other end if something has actually been sent over the wire.– ckujauJan 22, 2014 at 19:54
-
True, but if the port isn't open, e.g. blocked by firewall, it will error. It's at least a smoke test without having to load software on either side.– BrettskiJan 22, 2014 at 20:25