Nearby devices

What is netbiosd?

netbiosd handles NetBIOS names, the naming system of Windows networks. Its traffic stays on the local network. The Mac's file sharing settings decide what it does.

Process: netbiosdMade by AppleApplies to: macOS 14 Sonoma and later. Checked on macOS 27.2.Checked: 1 November 2026

Short answer

Part of macOS. It registers and browses NetBIOS names for Windows-style file sharing. Its traffic stays on the local network.

Safe to block

Safe to block if you don't share files with Windows computers. It's cleaner to turn off File Sharing, which configures it.

Path
/usr/sbin/netbiosd
launchd label
com.apple.netbiosd
Signing identifier
com.apple.netbiosd

What it is

The man page says that netbiosd registers and defends NetBIOS names. It also browses names on the network and gives them to the system through mDNSResponder.

The man page says that its configuration comes from the SMB file sharing settings of the Mac.

The program is /usr/sbin/netbiosd. launchd starts it for the system as com.apple.netbiosd.

Apple lists UDP port 137 for the NetBIOS name service and UDP port 138 for the NetBIOS datagram service.

Why it uses the network

  • Name registration. It registers the Mac's NetBIOS name on the local network, so Windows computers can find it by name.
  • Browsing. It looks for other computers and workgroups on the network.

How much is normal

Small local traffic is usual. It doesn't use your internet connection.

A firewall prompt about incoming connections for netbiosd is expected. Windows computers send it name queries.

The man page describes only NetBIOS on the local network.

When it uses a lot, and why

  • A busy Windows network. On an office network with many Windows computers, there are more names to browse and more name queries.

Is it safe to block?

Safe to block

Safe to block if you don't share files with Windows computers. It's cleaner to turn off File Sharing, which configures it.

What breaks if you block it

  • Windows computers may not find this Mac by its NetBIOS name.
  • Browsing Windows computers and workgroups from the Finder may show fewer computers.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

  1. Check whether you share files. Choose Apple menu › System Settings › General › Sharing.

  2. Turn off File Sharing if you don't use it. The netbiosd man page says that its configuration comes from the SMB settings.

  3. Don't quit netbiosd in Activity Monitor. macOS starts it again.

See how much it uses

  1. In Terminal, list its open sockets. Ports 137 and 138 are NetBIOS.

    sudo lsof -nP -i -a -c netbiosd

    Needs an administrator password.

With Kilobat

  1. In the Kilobat app list, search for netbiosd. Its row shows the live rate and what it moved today.

  2. In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online.

  3. In Terminal, ask the same question. Add --json for scripts and agents.

    kilobat explain 'netbiosd'

  4. Show its traffic over one day.

    kilobat bandwidth 'netbiosd' day

  5. Through MCP, an AI agent asks explain_connection with the process name. It gets the same facts.

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

What isn’t documented

The man page doesn't say when macOS starts netbiosd with File Sharing off, or how often it browses.

Questions

Is netbiosd a virus?

The genuine macOS netbiosd is in /usr/sbin, has a man page and is started by launchd. Check the process path and signature if you are unsure.

Does netbiosd send data to the internet?

The man page describes only NetBIOS on the local network. Apple's port list names it for Windows name and datagram services.

Should I allow netbiosd in the firewall?

Allow it if Windows computers need to find this Mac by name. Otherwise, blocking incoming connections is fine.

Sources

Checked on 1 November 2026.