NetBIOS over TCP/IP (thing)

A software interface on Windows computers, enabled by default, that allows the use of legacy NetBIOS-based services via a TCP/IP network. Such resources include file sharing on Windows 95, Windows 98 and possibly Windows ME systems. I think Samba also still uses NetBT for its services. It must be enabled if you want to provide or access legacy resources. The name is often abbreviated to NetBT.

Enabling this option opens the following TCP/IP ports on the network interface:

• netbios-ns (137/udp). The NetBIOS Name Service is a name-resolution service, like DNS. Often a gethostbyaddr() call on a Windows system will trigger both a DNS lookup and a flurry of requests on port 137 for the target machine. Deprecated in favour of DNS or WINS.
• netbios-dgm (138/udp). This service provides an interface for NetBIOS datagram packets to be sent via the TCP/IP network. A NetBIOS datagram is equivalent to a UDP datagram. The Browser service uses port 138 to locate other computers for display in the Network Neighbourhood. Blocking it (or disabling NetBT altogether) will stop your computer from showing up in the Network Neighbourhood. Deprecated in favour of UDP. Current systems (Win2k and above) will attempt to register their names through Dynamic DNS updates.
• netbios-ssn (139/tcp). The NetBIOS session service is where most of the "business" of NetBT takes place. It is most commonly used by the Windows File/Print/Named Pipe Sharing service on legacy systems. Deprecated in favour of CIFS running over the microsoft-ds port (445/tcp).

The upshot of all this is: Disable NetBT. Modern Windows systems (2000/XP and later) use CIFS to provide File/Print/Named pipe Sharing natively through TCP/IP. Failing to do so can leave your computer vulnerable, especially if you connect to the Internet and your ISP isn't intelligent enough to block the ports themselves.

If you need to access/provide services to legacy Windows 9x systems then consider installing the NetBEUI transport protocol on the systems involved. NetBEUI is the transport that NetBT is supposed to replace; since it is a non-routable protocol it cannot be accessed "accidently" by people outside your LAN.

I am told that Windows can also use IPX as a transport for NetBIOS; you may find this convenient if you already have IPX installed (or don't want to install NetBEUI).

The only reason you should enable NetBT is if you need to access/provide legacy services to machines accross a TCP/IP network such as the Internet and there are no secure alternative protocols or tunneling systems available, such as Terminal Services and SFTP, or VPN and SSH.