Protocol Basics
Layer: Session
Transport: TCP, UDP
Port(s): 137, 138, 139
RFC(s): 1001, 1002

NetBIOS is an API developed in the early 1980s by IBM to allow applications on separate computers to communicate over a network. Although NetBIOS usually runs over TCP/IP (NetBT) now, it can also be used over IPX/SPX and NetBEUI. NetBIOS provides three services for network communication.

Name Service

Typically, NetBIOS uses broadcasts to register its name on the network. In effect, this service works like a dynamic peer-to-peer DNS. Modern networks implement a centralized name server (Microsoft's WINS service, for example) to overcome the drawbacks of a broadcast-based name service. NetBIOS over TCP/IP operates the Name Service over 137/UDP.

Session Service

The Session Service provides a method for two devices to establish a connection. Once the connection is established, the Session Service exchanges data between the two end points. NetBIOS over TCP/IP operates the Session Service over 139/TCP.

Datagram Distribution Service

The Datagram Distribution Service handles connectionless communication between devices. This service can send packets to a unique name or broadcast. NetBIOS over TCP/IP operates the Datagram Distribution Service over 138/UDP.

SMB is the network protocol used for file and printer sharing in Windows-based networks. Although they are often confused, it's important to note that SMB and NetBIOS are not the same thing. SMB works at a higher layer than NetBIOS and uses both the Session and Datagram Distribution Services to exchange data.