O que é o NetBIOS? O Windows precisa das portas 137 e 138 abertas?

Question

Eu nunca entendi o NetBIOS. Eu não entendi o artigo da Wikipedia sobre isso. Pesquisei no YouTube, mas não consegui encontrar um vídeo explicando o que é NetBIOS.

O que o NetBIOS faz? Estou usando uma máquina com Windows XP e as portas 137, 138 parecem estar abertas na minha máquina. Devo fechá-los? Ou o meu Windows precisa deles abertos para algum propósito? Se não, por que eu precisaria do NetBIOS?

    

Answer 1

Em hackerthreads.org :

NetBIOS stands for Network basic input output system and is used in Windows for its file and printer sharing.

De Wikipedia :

It provides services related to the session layer of the OSI model allowing applications on separate computers to communicate over a local area network.

De TechNet :

A Session layer programming interface. NetBIOS is a standard application programming interface (API) at the Session layer of the Open Systems Interconnect (OSI) reference model so that user applications can utilize the services of installed network protocol stacks. An application that uses the NetBIOS interface API for network communication can be run on any protocol stack that supports a NetBIOS interface.'

A session management and data transport protocol NetBIOS is also a protocol that functions at the Session and Transport layers and that provides commands and support for the following services:

• Network name registration and verification.
• Session establishment and termination.
• Reliable connection-oriented session data transfer.
• Unreliable connectionless datagram data transfer.
• Protocol and adapter monitoring and management.

NetBIOS over TCP/IP (NetBT) sends the NetBIOS protocol over the Transmission Control Protocol (TCP) or the User Datagram Protocol (UDP).

De outro artigo da TechNet, implementação do NetBIOS sobre TCP / IP? :

The Windows 2000 implementation of NetBIOS over TCP/IP is referred to as NetBT. NetBT uses the following TCP and UDP ports:

• UDP port 137 (name services)
• UDP port 138 (datagram services)

• TCP port 139 (session services)

  NetBIOS over TCP/IP is specified by RFC 1001 and RFC 1002. The Netbt.sys driver is a kernel -mode component that supports the TDI interface. Services such as workstation and server use the TDI interface directly, while traditional NetBIOS applications have their calls mapped to TDI calls through the Netbios.sys driver. Using TDI to make calls to NetBT is a more difficult programming task, but can provide higher performance and freedom from historical NetBIOS limitations.

Aarquiteturaseriaassim:

Você pode tentar um hack no NetBIOS sobre o uso de SSN - NetBIOS no Linux:

C:\>nbtstat.exe -a morpheus

<Local Adapter Name>:
Node IpAddress: [<local IP address>] Scope Id: []
NetBIOS Remote Machine Name Table
Name    Type    Status
MORPHEUS <00>   UNIQUE  Registered
MATRIX <00>     GROUP   Registered
MORPHEUS <20>   UNIQUE  Registered

MAC Address = <Remote MAC address>

C:\>nbtstat.exe -c

<Local Adapter Name>:
Node IpAddress: [<local IP address>] Scope Id: []

Como o NetBT se comporta com os aprimoramentos de DNS / Internet:

    

Answer 2

Gostaria de acrescentar que, para versões do Windows a partir do Windows 2000, todas as funcionalidades herdadas de NetBIOS das portas 137, 138 e 139 são tratadas, por padrão, pelo SMB (Server Message Block) pela porta 445. Se os computadores em ambas as extremidades da conexão de rede são Windows 2000 ou posterior, você pode seguramente bloquear as portas 137, 138 e 139 enquanto a porta 445 estiver aberta