What's port 445 used for in Windows 2000 and later versions?

A. In pre-Win2K versions of Windows, the Server Message Block (SMB) protocol runs over NetBIOS, which in turn can run over TCP/IP. This combination of NetBIOS over TCP/IP is known as NetBT and uses UDP ports 137 and 138 and TCP port 139.

Win2K introduced the ability to run SMB directly over TCP/IP without the NetBIOS layer. This new direct TCP/IP SMB runs over port 445 and is the preferred method for running SMB.

By default, Win2K and later use SMB over TCP/IP rather than over NetBT whenever possible. However, if NetBIOS over TCP/IP is enabled and an SMB query to port 445 fails (meaning the target computer doesn't support SMB over TCP/IP), the system will use the older SMB over NetBT.

You can use the Netstat command to check the status of ports in use. To do so, open a command line and type

netstat -an

The -an switch shows all listening ports in numeric format. The output will show which ports are listening. If only port 445 is listening, NetBT is disabled. If ports 137, 138, and 139 are also listening, NetBT is enabled, as the following output shows:

Active ConnectionsProto Local Address Foreign Address StateTCP 0.0.0.0:445 0.0.0.0:0 LISTENINGTCP 192.168.1.50:139 0.0.0.0:0 LISTENINGUDP 0.0.0.0:445 *:*UDP 192.168.1.50:137 *:*UDP 192.168.1.50:138 *:*