1- SMB (Server Message Block)

Purpose: File sharing, printer access, remote services

Ports: TCP 445 (modern), TCP/UDP 137–139 (legacy)

Auth: NTLM / Kerberos

Attacks: EternalBlue, SMBGhost, IPC$ abuse, named pipes

Wireshark:

• tcp.port == 445
• smb || smb2
• smb2.cmd == 0x5
• smb.filename contains "IPC$"

2- NetBIOS

Purpose: Name resolution & session services on LANs

Ports: UDP 137/138, TCP 139

Use Cases: Legacy Windows name discovery

Attacks: NBNS spoofing, NetBIOS name poisoning

Wireshark:

• udp.port == 137 || udp.port == 138 || tcp.port == 139
• nbns