What is Port 445 (SMB)?

Port 445 is a critical TCP port primarily associated with the Server Message Block (SMB) protocol. SMB is a network file sharing protocol that allows applications on a computer to read and write files and to request services from server programs in a computer network. Developed by IBM and later significantly expanded by Microsoft, SMB is the backbone of file and printer sharing across Windows networks, and it's also implemented in various network-attached storage (NAS) devices and Linux/Unix systems via Samba.

Historically, SMB operated over NetBIOS using ports 137, 138 (UDP), and 139 (TCP). However, with the introduction of Windows 2000, Microsoft began allowing SMB to run directly over TCP/IP without the NetBIOS layer, using port 445. This direct hosting of SMB over TCP/IP significantly streamlined network communication and became the standard method for modern Windows operating systems and many other platforms.

While essential for legitimate network operations, port 445 has gained notoriety due to its frequent exploitation in major cyberattacks. Its widespread use, coupled with historical vulnerabilities in the SMB protocol itself, makes it a prime target for attackers seeking to gain unauthorized access, spread malware, or compromise entire networks. Understanding port 445, its underlying protocol, and its associated security risks is paramount for any organization or individual managing networked systems.

This guide will delve into the technical aspects of port 445, detail the critical security risks it poses, outline common attack vectors, provide methods for checking its status, and most importantly, offer comprehensive strategies for securing it against malicious exploitation.

Port 445 Technical Details

To fully grasp the security implications of port 445, it's essential to understand its technical underpinnings and how the SMB protocol functions.

The Server Message Block (SMB) protocol operates as a client-server communication protocol. A client requests access to a resource (like a file or printer) on a server, and the server responds by providing that access, subject to authentication and authorization checks. SMB facilitates various operations, including:

• File Access: Reading, writing, creating, deleting, and managing files and directories on remote shares.
• Printer Sharing: Sending print jobs to network printers.
• Inter-process Communication (IPC): Used by various Windows services for remote management and communication, including named pipes.
• Remote Administration: Many Windows management tools, including Group Policy and Active Directory services, rely on SMB for communication.

The evolution of SMB is also crucial to its security posture:

• SMBv1: The oldest version, widely considered insecure due to numerous vulnerabilities and design flaws. It lacks modern security features like pre-authentication integrity and robust encryption. Many major attacks, including WannaCry, exploited SMBv1 vulnerabilities. Microsoft strongly recommends disabling SMBv1.
• SMBv2: Introduced with Windows Vista and Windows Server 2008, SMBv2 brought significant performance improvements and enhanced security features, including larger read/write buffers, improved caching, and better error handling.
• SMBv3: Introduced with Windows 8 and Windows Server 2012, SMBv3 further enhanced performance and, more importantly, introduced critical security features like SMB Encryption (encrypting data in transit), SMB Multichannel (improving throughput and fault tolerance), and SMB Direct (leveraging RDMA for high-performance networking). SMBv3.1.1 (Windows 10/Server 2016) added pre-authentication integrity and AES-GCM encryption, making it the most secure version.

  When SMB runs directly over TCP port 445, it bypasses the NetBIOS layer entirely. This means that the SMB client directly initiates a TCP connection to port 445 on the server, and then SMB messages are encapsulated within that TCP session. This direct approach is more efficient and is the standard for modern Windows networks. However, it also means that if port 445 is exposed to untrusted networks, it directly exposes the SMB service to potential attacks, making robust firewalling and security configurations absolutely essential.

  Security Risks of Open Port 445

  An open or improperly secured port 445 represents a critical vulnerability that can lead to severe consequences for individuals and organizations. The SMB protocol, especially older versions, has been a consistent target for cybercriminals due to its fundamental role in network operations and the historical prevalence of exploitable flaws. When port 445 is exposed, particularly to the public internet or an untrusted internal network segment, it opens the door to a wide array of devastating attacks.

  Common Attacks on Port 445

  The history of port 445 is unfortunately replete with examples of devastating cyberattacks. Understanding these common attack vectors is crucial for developing effective defense strategies.

  How to Check if Port 445 is Open

  Identifying whether port 445 is open on your systems or accessible from external networks is the first crucial step in securing it. There are several methods, ranging from command-line tools to online scanners, that can help you determine its status.

  Using Nmap (Network Mapper)

  Nmap is a powerful, open-source tool for network discovery and security auditing. It's widely used by security professionals to scan for open ports, identify services, and detect vulnerabilities.

  • Basic Port Scan: To check if port 445 is open on a target IP address or hostname:

    nmap -p 445 target.com

    Replace target.com with the IP address or hostname you want to scan. If the output shows '445/tcp open', the port is accessible.

  • Service and OS Detection: To get more details about the SMB service running on port 445, including the operating system and SMB version:

    nmap -p 445 -sV --script smb-os-discovery target.com

    The -sV flag attempts to determine service versions, and smb-os-discovery is an Nmap script that tries to identify the OS and SMB details.

  • SMB Share Enumeration: To list accessible SMB shares (requires authentication or guest access):

    nmap -p 445 --script smb-enum-shares target.com

    This can reveal sensitive information about shared resources.

  • SMB Vulnerability Scanning: Nmap has scripts specifically designed to check for known SMB vulnerabilities, including EternalBlue:

    nmap -p 445 --script smb-vuln-ms17-010 target.com

    You can also use a wildcard to check for multiple SMB vulnerabilities:

    nmap -p 445 --script smb-vuln-* target.com

  Using Online Port Scanners

  For a quick external check, online port scanners can be very useful. These tools scan your public IP address from the internet to see which ports are open. This is particularly helpful for identifying if your router or firewall is exposing port 445 to the internet.

  You can easily Scan port 445 with our free tool, the Secably Port Scanner. Simply enter your public IP address or domain name, specify port 445, and initiate the scan to get an immediate assessment of its external accessibility.

  Using Built-in Operating System Tools

  • Windows: You can use netstat from the Command Prompt or PowerShell to see active connections and listening ports:

    netstat -an | findstr :445

    If you see an entry like TCP 0.0.0.0:445 0.0.0.0:0 LISTENING, it indicates that port 445 is open and listening on all network interfaces.

  • Linux/macOS: Similar to Windows, you can use ss or lsof to check listening ports:

    ss -tuln | grep 445

    or

    lsof -i :445

    These commands will show if any process is listening on TCP port 445.

  Regularly checking the status of port 445, especially after network changes or system updates, is a fundamental practice in maintaining a secure network posture. If you find port 445 open and it's not explicitly required, it should be secured or closed immediately.

  Free Security Tools

  Scan your website, check open ports, find subdomains — no signup required.

  • Website Vulnerability Scanner — find XSS, SQLi, misconfigurations
  • Port Scanner — Nmap-powered, all 65535 ports
  • Subdomain Finder — discover hidden attack surface

  See all tools →

  How to Secure Port 445

  Securing port 445 is a critical task for any organization or individual operating networked systems. Given its history of exploitation, a multi-layered approach is necessary to mitigate the risks associated with the SMB protocol. Here are comprehensive steps to harden port 445 and protect your network:

  When Should Port 445 Be Open?

  Despite its critical security risks, port 445 is fundamental to many legitimate network operations, particularly within Windows environments. Therefore, completely eliminating its use is often impractical. The key is to understand when it's necessary to have it open and, more importantly, how to restrict its accessibility to only authorized entities and networks.

  Port 445 should be considered for opening only in specific, controlled scenarios, almost exclusively within a trusted internal network, and never directly to the public internet without extreme justification and robust compensating controls.

  Legitimate Use Cases for Port 445:

  • File Servers and Network-Attached Storage (NAS): The most common use case. File servers (Windows Server, Samba on Linux, dedicated NAS appliances) rely on SMB over port 445 to provide shared folders for users and applications. This allows multiple users to access and collaborate on files centrally.
  • Print Servers: Similar to file sharing, print servers use SMB to manage and share network printers, allowing client machines to send print jobs.
  • Domain Controllers (Active Directory): Active Directory, the cornerstone of Windows network management, heavily relies on SMB for various functions. This includes Group Policy updates, user authentication, and replication between domain controllers. Without port 445, Active Directory services would largely cease to function.
  • Remote Administration and Management: Many Windows management tools, including PowerShell Remoting (though it primarily uses WinRM, some underlying components might interact with SMB), remote registry access, and other administrative functions, can utilize SMB for communication.
  • Specific Applications: Certain legacy or specialized applications might require SMB for data exchange, licensing, or inter-process communication with other services on the network.
  • Backup Solutions: Many network backup solutions use SMB to access shared folders on client machines or to store backups on network shares.

  Strict Conditions for Opening Port 445:

  Even in these legitimate scenarios, port 445 should never be indiscriminately open. Strict access controls are paramount:

  • Internal Network Only: Port 445 should be blocked at the perimeter firewall, preventing any direct access from the internet.
  • Network Segmentation: Isolate systems requiring SMB into specific VLANs or network segments. For instance, file servers should be in a server VLAN, and only specific client subnets should be allowed to connect to them on port 445.
  • IP Whitelisting: Configure internal firewalls (both host-based and network-based) to allow connections to port 445 only from specific, trusted IP addresses or subnets that genuinely need access.
  • VPN for Remote Access: If remote users or branch offices need to access SMB shares, they must connect via a Virtual Private Network (VPN). The VPN creates a secure tunnel, making their connection appear as if it originates from the internal network, thus protecting the SMB traffic from direct internet exposure.
  • Strong Authentication and Authorization: Always enforce strong passwords, multi-factor authentication where possible, and the principle of least privilege for SMB share access.
  • Latest SMB Version and Patches: Ensure all systems use SMBv3 (or higher) and are fully patched against known vulnerabilities. Disable SMBv1 across the board.

  In summary, while port 445 is essential for many network services, its exposure must be meticulously controlled. Any decision to open it, even internally, should be accompanied by a thorough risk assessment and the implementation of robust security measures.

  Is port 445 dangerous?

  Yes, port 445 is considered critically dangerous if it is left open and unprotected, especially to the public internet. Its underlying protocol, Server Message Block (SMB), has a long history of severe vulnerabilities, including those that enable remote code execution, ransomware propagation (like WannaCry and NotPetya), and data theft. If an attacker can reach an unpatched or misconfigured SMB service on port 445, they can often gain full control of the system, spread malware laterally across a network, or steal sensitive data. Therefore, proper security measures are absolutely essential.

  Should I close port 445?

  Generally, yes, you should close or severely restrict access to port 445. For any system directly exposed to the internet, port 445 should be blocked at the perimeter firewall without exception, unless there's a very specific, highly secured, and monitored business requirement (e.g., VPN-only access to a specific SMB share). Within an internal network, you should restrict access to port 445 to only those specific IP addresses, subnets, or systems that legitimately need to communicate via SMB. This often involves using host-based firewalls, network segmentation (VLANs), and IP whitelisting. Disabling SMBv1 on all systems is also a critical step, as it's the most vulnerable version of the protocol.

  How do I block port 445?

  Blocking port 445 can be done at various levels:

  1. At the Network Perimeter (Router/Firewall):

  Configure your router or hardware firewall to deny all inbound connections to TCP port 445 from the internet (WAN side). The exact steps vary by device, but typically involve creating an inbound firewall rule.

  2. On Linux Systems (iptables/ufw):

  • Using iptables (for direct configuration):

    sudo iptables -A INPUT -p tcp --dport 445 -j DROP

    This command drops all incoming TCP traffic to port 445. To allow specific IP addresses or subnets while blocking others, you'd add an ACCEPT rule first:

    sudo iptables -A INPUT -p tcp --dport 445 -s 192.168.1.0/24 -j ACCEPT
    sudo iptables -A INPUT -p tcp --dport 445 -j DROP

    Remember to save your iptables rules so they persist after reboot (e.g., using sudo netfilter-persistent save or similar for your distribution).

  • Using UFW (Uncomplicated Firewall - for Ubuntu/Debian):

    sudo ufw deny 445/tcp

    To allow specific IP addresses or subnets:

    sudo ufw allow from 192.168.1.0/24 to any port 445

    Then ensure UFW is enabled: sudo ufw enable.

  3. On Windows Systems (Windows Defender Firewall):

  You can block port 445 using the Windows Defender Firewall with Advanced Security:

  1. Open 'Windows Defender Firewall with Advanced Security' (search for it in the Start Menu).
  2. In the left pane, click 'Inbound Rules'.
  3. In the right pane, click 'New Rule...'.
  4. Select 'Port' and click 'Next'.
  5. Select 'TCP' and enter '445' in 'Specific local ports'. Click 'Next'.
  6. Select 'Block the connection' and click 'Next'.
  7. Choose when the rule applies (Domain, Private, Public - typically all for blocking). Click 'Next'.
  8. Give the rule a name (e.g., 'Block Port 445 Inbound') and an optional description. Click 'Finish'.

  You can also disable the 'File and Printer Sharing for Microsoft Networks' component in network adapter settings, though this is a more drastic measure.

  What runs on port 445 by default?

  By default, TCP port 445 is used by the Server Message Block (SMB) protocol. This protocol is primarily used for network file sharing, printer sharing, and various remote administration tasks on Windows operating systems. It's also utilized by Active Directory for domain services, Group Policy updates, and inter-domain controller communication. Many Network-Attached Storage (NAS) devices and Linux/Unix systems running Samba also use port 445 to provide SMB services, allowing them to integrate seamlessly into Windows networks for file and print sharing.

  Related Security Guides

  • Vue.js Security Guide
  • Financial Services Security Guide
  • CVE-2025-27020
  • CVE-2025-66456

  Scan your website for free

  No signup needed. Get results in under 60 seconds.

  Run Free Scan →