41

My (application) firewall settings are configured to block incoming connections from netbiosd. I don't recall setting this myself, and wonder what the consequences are.

enter image description here

What are the consequences of blocking incoming connections for netbiosd? If I generally block incoming connections as a precaution, should I block netbiosd as well?

Improve this question
4
  • Same here, but also dozens of OUTGOING connection attempts, that are even more suspicious. I am at home, with NAT and all, and I only opened one IP for outside access, and I get zillions of IPs from all around the world trying to connect to my iMac. my Firewall (same as OPs) warns, and I usually block these. But I've seen dozens of outgoing attempts, again to many IP numbers I do not know. Now WHO is trying to connect from my Mac outside using netbios, and how can I ever know which of these is legitimate?
    – Motti Shneor
    Commented Jun 25, 2016 at 13:02
  • 1
    @MottiShneor This is where a preogram Little Snitch helps it asks for each outbound connection to be allowed or denies per app and external endpoint
    – mmmmmm
    Commented Oct 26, 2016 at 11:41
  • @Mark: Yes, that's how I first noticed the traffic, but its typically unclear just how to use Little Snitch in any given situation. Here, for example, the question still applies.
    – orome
    Commented Oct 26, 2016 at 13:07
  • I was responding to the comment and not your question
    – mmmmmm
    Commented Oct 26, 2016 at 15:24

2 Answers 2

Reset to default
44

netbiosd is responsible for interacting with NetBIOS networks. NetBIOS is Microsoft's networking service.

If you block incoming netbiosd connections then you will not be able to share drives over netbios which is the simplest way to share data to Windows machines.

If you generally block incoming connections as a precaution the you should block anything until you actually need it, that is until something breaks. So yes block netbiosd to begin with.

Improve this answer
6
  • So is it safe to say that if I have no Windows machines there will be no consequences? Also: I don't recall ever setting this; could it somehow have happened automatically?
    – orome
    Commented Feb 11, 2013 at 16:54
  • Will I still be able to use arbitrary networks (e.g., wifi in a client's conference room; hotel wifi) if I block netbiosd incoming connections?
    – orome
    Commented Feb 12, 2013 at 15:16
  • How are you using the networks netbiosd will affect Windows file sharing and possible windows authentication but not web use etc.
    – mmmmmm
    Commented Feb 12, 2013 at 15:18
  • 3
    → raxacoricofallapatorius: you most probably blocked netbiosd access the first time you entered a Windows network where you were immediatly bombed by all Windows neighbor netbios broadcasting like a flock of geese. MacOS X asked you if you wanted to accept or block this unsollicited access. I bet that you blocked it. And this was an excellent reflex ☺!
    – athena
    Commented May 10, 2013 at 8:16
  • 2
    A related answer also supports blocking or disabling netbiosd.
    – orome
    Commented Feb 11, 2014 at 12:53
7

NetBIOS is legacy for decades. Before IP became more or less the standard layer 3 network protocol also in home/company networks, other protocols were directly used on top of layer 2 networks (layer 2 means Ethernet, Token Ring, etc.) One of them was NetBIOS, created by IBM in 1983 and it became very popular as Microsoft decided to use it for Windows. Another popular one was IPX, created by Xerox in the late 80s, which became very popular as Novell used it in their NetWare operating system.

Later on that protocol was split into two parts: NetBUI and NetBIOS. NetBUI was the low level part, that allowed NetBIOS to run directly on top of layer 2, whereas NetBIOS was on a higher level and thus could now also be used on top of the IP protocol stack, since IP more and more replaced all other layer 3 protocols. That way Microsoft could continue to use NetBIOS, even though IP became the new standard layer 3 protocol in Windows.

NetBIOS implements three things:

  1. Name resolution, comparable to DNS (or rather mDNS)
  2. Datagram service, communication comparable to UDP
  3. Session service, communication comparable to TCP

Today it is mainly used by Windows for name resolution and service discovery, comparable to DNS-SD on macOS/Linux (Apple calls it Bonjour), SSDP (the discovery protocol of UPnP), or SLP (which is mainly used for discovering network printers today). It's only used as a communication protocol when trying to connect to a very old Windows machine, where protocols like SMB would still run on top of NetBIOS (today they run on top of TCP/IP).

NetBIOS is very inefficient in larger networks as it works with broadcasts and it produces a lot of broadcast traffic; there are companies where 30% of all network traffic on the LAN are NetBIOS broadcasts. SSDP and DNS-SD are more efficient, as they use multicast instead of broadcasts and try to limit the amount of announcements to a reasonable level. DNS-SD even uses service caching which can further reduce the amount of multicast traffic dramatically. IMHO DNS-SD is the best discovery protocol in use, it's the discovery protocol of ZeroConf, which is widely supported by Linux systems and also by macOS (Apple calls it Bonjour but that's just the name of Apples ZeroConf implementation).

Blocking netbiosd is safe, it will only prevent your Mac from announcing services via NetBIOS broadcasts and it will prevent your system from receiving NetBIOS broadcasts. This has two consequences:

  1. Windows machines will not "see" your computer on the LAN. If you share directories of your Mac, this will not be known by Windows computers. However, they can still access them if required. They will only need to know your IP address and when opening \\<YourIP>\, they get a list of available shares or they can directly connect to a share using \\<YourIP>\<ShareName> (of course only after successful authentication).

  2. Your Mac won't be able to "see" Windows machines in the LAN that only announce their shares via NetBIOS. You can still access such shares if you know their IP address. Therefor you open Finder, select Go > Connect to Server... (or CMD+K) and enter smb://<IP> or smb://<IP>/<ShareName>. Newer Windows machines, that also announce their shares via SSDP are seen by macOS, since Bonjour also understands SSDP multicasts.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .