Port 445 SMB – Free, Online, Private

What listens on 445

Port 445 is SMB over TCP. The IANA name is microsoft-ds. It is how Windows maps drives, how many file servers share directories, and how a long list of worms moved. The older NetBIOS session service is TCP 139, which is a different port and not required for SMB on 445. The registry lists UDP as well. The file sharing you need to worry about is TCP. A host that shows 445 open on a public address is offering remote access to its files and, depending on the configuration, to named pipes that lead to administration.

The IANA service name is microsoft-ds: Microsoft-DS. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 445. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 445

Service notes for port 445: the IANA name is microsoft-ds (Microsoft-DS), and the program people mean is SMB. TCP 445 is the IANA microsoft-ds port. It is SMB, and it should not be reachable from the internet. Do not expose 445 to the internet. There is no safe public SMB. Restrict it to the private network that holds the clients, and prefer a VPN or an identity-aware share over a flat allow. Disable SMBv1. Require signing. A guest or anonymous share is a data breach that a scanner will find. If the host is not a file server, 445 should be closed, including on a laptop that joined a cafe network. The port is well known and it is scanned. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 445, you are on the wrong page.

A cloud security group with 445 open 'for the office' and a 0.0.0.0/0 source is the incident. Read the source, not only the port. Another trap is a Linux host running Samba because a package suggested it, on a machine that was supposed to be a web server. ss shows smbd. Another is testing from inside the VPC, seeing a success, and concluding the internet cannot reach it. Test from outside, or read the route and the group. Another is blocking 445 and leaving 139.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 445 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. On a file server, TCP 445 belongs to smbd or the Windows server process, on the internal address. On anything else, no listener is the goal. From outside the network, nc should time out or be refused. A completed handshake from the internet is a problem, not a healthy check.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• Port 139 is the older NetBIOS session port. Closing 445 and leaving 139 is incomplete.
• UDP 445 in the registry is not the share you mount.
• An internal success does not prove the port is closed externally.
• SMB signing and the dialect are configuration. The port being filtered is the first control.

Linuxsudo ss -lptn 'sport = :445'
sudo lsof -nP -iTCP:445 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:445 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.445[^0-9]'

Windowsnetstat -ano | findstr :445
Get-NetTCPConnection -LocalPort 445

Remotenc -vz host 445