What it's for
Port 445 carries SMB (Server Message Block), the protocol Windows uses for file sharing, printer sharing, and various inter-process communication on a network. When you map a network drive, browse a shared folder (\\server\share), or access a shared printer on a Windows network, that traffic runs over port 445.
Modern SMB (from Windows 2000 onward) runs directly over TCP on port 445, whereas older implementations relied on NetBIOS over TCP/IP using port 139 — you'll still see both in the wild, especially in mixed legacy environments.
Protocol basics
- Protocol: TCP, since file sharing needs reliable ordered delivery for directory listings and file transfers.
- Direct TCP transport (modern SMB). Unlike the older NetBIOS-based approach, SMB over port 445 doesn't need a NetBIOS session layer — it runs directly atop TCP/IP, simplifying and speeding up the protocol stack.
- Authentication built in. SMB sessions are authenticated (typically via NTLM or Kerberos in an Active Directory environment), and access is governed by share-level and file-level permissions on the server.
- Versions matter a lot. SMBv1 (the original, notoriously insecure version) is deprecated and should be disabled; SMBv2 and SMBv3 add substantial security and performance improvements, including encryption support in SMBv3.
Security considerations
- Port 445 should almost never be exposed directly to the internet. It's one of the most commonly exploited ports in ransomware and worm campaigns — EternalBlue (used by WannaCry and NotPetya) specifically targeted an SMBv1 vulnerability on this exact port.
- Disable SMBv1 entirely on any modern Windows environment — it lacks the security improvements of later versions and remains one of the most exploited legacy protocols still found on production networks.
- Restrict port 445 to internal/trusted networks only, ideally behind a VPN for remote access rather than direct internet exposure — there is essentially no legitimate reason for this port to be open to the public internet.
- Use SMB signing and, where possible, SMBv3 encryption to prevent man-in-the-middle tampering and eavesdropping on file-share traffic within your network.
Troubleshooting
Can't access a network share:
- Check that port 445 (and/or 139 for legacy NetBIOS setups) is open between the client and server, particularly across VLANs or through firewalls
- Verify the requesting user has appropriate share and NTFS permissions on the target folder
"The specified network name is no longer available":
- Often an SMB version mismatch, a dropped session due to network instability, or the server-side SMB service having restarted
Slow file transfers over SMB:
- Could be SMBv1 still being negotiated due to compatibility settings — forcing SMBv3 (with multichannel support) typically improves throughput meaningfully on modern networks
Connection works locally but not remotely:
- Port 445 is very commonly blocked at the perimeter firewall by design (see security notes above) — for remote access, use a VPN into the internal network rather than trying to expose SMB directly
Comparison / FAQ
| Port | Protocol | Key difference from 445 (SMB) |
|---|---|---|
| 139 (NetBIOS) | TCP | Legacy transport for SMB before it moved to running directly over TCP; still seen in older/mixed environments |
| 3389 (RDP) | TCP | Full remote desktop session rather than file/printer sharing, though both are common Windows-network targets for attackers |
Why is port 445 considered so risky to expose?
Because it has a long history of high-severity, widely exploited vulnerabilities (most notably EternalBlue/WannaCry), and because file-sharing protocols inherently expose sensitive data and write access if misconfigured. The standard guidance is to keep it strictly internal.
What's the difference between port 445 and port 139 for SMB?
Port 139 is the legacy NetBIOS-based transport for SMB, requiring a NetBIOS session layer. Port 445 is direct SMB over TCP/IP without that NetBIOS dependency, and is what modern Windows systems use by default.
Should I disable SMBv1 even if I'm not using port 445 externally?
Yes — SMBv1 has known critical vulnerabilities regardless of whether the port is internet-facing, since an attacker who gains any internal network foothold can still exploit it. Modern Windows disables SMBv1 by default for this reason.
Can I safely use SMB shares over a VPN for remote work?
Yes, this is the recommended pattern — VPN traffic is encrypted and the SMB port itself stays closed to the raw internet, so remote users get file-share access without exposing port 445 directly.