I don't need any broadcasting/autodiscovery, everything is deterministic and strictly configured in my nets. I drop trash SAMBA broadcasts by firewall anyway, can't I just disable them to keep my network traffic clean?

  • 1. You wil get better answers if you indicate your OS and version, and Samba version as well. 2. Does Samba generate enough broadcast traffic that it actually causes anything bad to happen? In other words, why are you worried about this? – mfinni Jun 29 '10 at 2:05
  • No problem there is, but I'd like only meaningful traffic to take place - just for tidiness. The OS is Ubuntu 10.04 Serer x64, SAMBA is the standard one from the repo. – Ivan Jun 29 '10 at 4:49

Kill nmbd

edit your rc/init scripts that launch smbd and nmbd so they don't run nmbd. nmbd is the automatic discovery component of samba. Disabling it will cut down on the traffic.



In Debian at least, you could use the option 'disable netbios = yes' in your smb.conf file. I think this is a better option than edit the init scripts. This way you will not have to edit the init scripts every time they get overwritten by upgrades.

  • 2
    I can confirm that this is the best option on Ubuntu 14.04 too - the /etc/init/nmbd.conf file checks to see if disable netbios = yes is found in /etc/samba/smb.conf and does not launch nmbd. – Adam Kerz May 26 '15 at 3:34

Just using disable netbios = yes in your config file won't stop the nmbd from running from the init.d script. You need to manually comment out the nmbd options from the script after killing nmbd because nmbd will start again after restarting samba services or a reboot.

You can check if netbios isn't running any more by using the following command:

netstat -an | grep 137 (or 138)

This will show if there are listeners active on your system using the port numbers 137 (netbios name) and 138 (Netbios datagram).

  • Incorrect on Ubuntu 14.04 and apparently Debian too (no surprise). – Adam Kerz May 26 '15 at 3:37

I've actually did some iptable rules about netbios instead of disabling it.
(But of course you can disable it with adding disable netbios = yes through smb.conf file in the [global] section).

I were running a dedicated server but they actually continuously told me there are netbios attacks so I made a VPN for my clients.
(if you are running a server through a router you don't need to set up a VPN but if you are using remote connections from TCP/IP for network sharing, I really advise you to do one).

So there is my solution (replace the IP range by yours like depending on your router's IP assignments):

First reject all connections used by netbios ports through iptables:

iptables -A INPUT -p udp -m udp --dport 137 -j REJECT
iptables -A INPUT -p udp -m udp --dport 138 -j REJECT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j REJECT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j REJECT

This is blocking:

  • UDP port 137 for NetBios Name Service
  • UDP port 138 for NetBios Datagram services
  • TCP port 139 for NetBios Session services
  • TCP port 445 for NetBios Microsoft Discovery Service

Second you'll accept all local (or VPN) clients to access netbios ports through iptables:

iptables -A INPUT -p udp -m udp -s --dport 137 -j ACCEPT
iptables -A INPUT -p udp -m udp -s --dport 138 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s --dport 139 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s --dport 445 -j ACCEPT

According this config that will accept connections from all ip with through

You might find more info for IP routing there: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation

I hope that helps.

  • The order of iptables rules is important: if the any-address REJECT rules are placed before more specific ACCEPT rules, the ACCEPT rules will be ineffective. The first matching rule wins. – telcoM Sep 25 '19 at 11:18

For me, on Debian 10, even after adding disable netbios = yes to /etc/init/nmbd.conf in a [global] section, sudo netstat -an | grep 137 and sudo netstat -an | grep 138 still showed nmbd was running and using those ports.

I had to do this to disable nmbd:

sudo systemctl stop nmbd
sudo systemctl disable nmbd
sudo systemctl mask nmbd

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.