SMB (Server Message Block)
SMB (Server Message Block) is Microsoft's protocol for sharing files, printers and some remote administration between machines on a local network, most commonly reached on TCP port 445. AdminKit's guide explains why CISA still tells every network to block SMB at the internet-facing perimeter entirely.
By AdminKit team, Netbase JSC · Updated
SMB (Server Message Block) is Microsoft’s protocol, specified in MS-SMB2, for sharing files, printers and some remote-administration functions between machines on a network, with Samba providing a compatible implementation on Linux and other systems. IANA’s service name and port number registry lists TCP port 445 as microsoft-ds, the direct-hosted transport SMB uses without NetBIOS underneath it. SMB assumes it runs on a trusted local network: a host that answers on 445 from the open internet offers file shares, printer shares and NTLM authentication to anyone who finds it, not just intended local users. The 2017 EternalBlue exploit (CVE-2017-0144) targeted a flaw in the older SMBv1 version specifically, letting the WannaCry and NotPetya ransomware outbreaks spread between unpatched, internet-reachable hosts with no credentials needed at all — the reason CISA’s guidance still names SMB a high-risk service to block at the network boundary, regardless of version.