Internet-Security.com TCP port 139 details

TCP 139 is the NetBIOS Session Service used by SMB over NetBIOS (often called SMB1/NetBIOS).
Microsoft Windows file and printer sharing (LanmanServer) on Windows NT/2000/XP/Server 2003/2008 commonly exposes SMB on 139, and many legacy Windows deployments still do.
Samba’s smbd on Linux/Unix and NAS platforms (e.g., Synology DSM, QNAP QTS, TrueNAS) listens on 139 when NetBIOS support is enabled to serve SMB/CIFS shares.
Legacy Windows workgroup browsing and some domain logon routines use 139 alongside UDP 137/138 via NetBIOS.
Many multifunction printers/scanners (e.g., older HP LaserJet and Canon models) use SMB1 over 139 for “Scan-to-Share” to Windows/Samba folders.
Administrative tools that rely on SMB/NetBIOS—such as Microsoft PsExec, older SCCM client push, and Windows net use/robocopy—can traverse 139 when 445 is unavailable.
Security: Port 139 is frequently targeted for SMB null-session enumeration, SMB credential brute-forcing, and MS08-067 (Conficker) exploitation of the Windows Server service reachable over 139/445.
Modern SMB prefers 445 (direct hosting), but 139 remains present in many legacy Windows and Samba/NAS environments.

TCP 139