NetBIOS

NetBIOS, short for Network Basic Input/Output System, is a software abstraction that provides a portable API for applications on local area networks to perform basic input/output and simple name resolution. It originated in the 1980s as part of IBM’s early LAN technology and was adopted by Microsoft for Windows networking. NetBIOS itself is not a transport protocol; it defines services that rely on an underlying network to carry data, which allowed programs to be written without depending on a specific network.

The NetBIOS architecture comprises three main components: the NetBIOS API (the programming interface used by applications), NetBIOS names and the name service (for resolving names to addresses), and the NetBIOS session and datagram services (for establishing connections and sending messages). NetBIOS can run over various transports, most notably NetBEUI in early networks and, later, NetBIOS over TCP/IP (NBT). Over TCP/IP, NetBIOS uses UDP ports 137 (name service) and 138 (datagram service) and TCP port 139 (session service). Name resolution can occur via broadcast, or through a centralized service such as WINS or static maps in hosts files.

NetBIOS names are 16-byte identifiers, typically up to 15 characters plus a suffix that indicates the service type (for example, 0x00 for a workstation and 0x20 for a file server). In modern Windows networks, SMB traffic commonly uses NetBIOS only for backward compatibility, while DNS and SMB over TCP/IP (port 445) handle most name resolution and file sharing. NetBIOS remains a legacy component and is often disabled or deprecated in new environments.