--- title: "netbiosd: what it is, why it uses the network, and whether to block it · Kilobat" url: "https://kilobat.app/processes/netbiosd" description: "netbiosd handles NetBIOS names for Windows-style file sharing on a Mac. What its local traffic is, and what breaks if you block it or turn off File Sharing." --- Nearby devices # What is netbiosd? `netbiosd` handles NetBIOS names, the naming system of Windows networks. Its traffic stays on the local network. The Mac's file sharing settings decide what it does. Process: `netbiosd` · Made by Apple · Applies to: macOS 14 Sonoma and later. Checked on macOS 27.2. · Checked: 1 November 2026 ## Short answer Part of macOS. It registers and browses NetBIOS names for Windows-style file sharing. Its traffic stays on the local network. Safe to block Safe to block if you don't share files with Windows computers. It's cleaner to turn off File Sharing, which configures it. Path `/usr/sbin/netbiosd` launchd label `com.apple.netbiosd` Signing identifier `com.apple.netbiosd` ## What it is The man page says that `netbiosd` registers and defends NetBIOS names. It also browses names on the network and gives them to the system through mDNSResponder. The man page says that its configuration comes from the SMB file sharing settings of the Mac. The program is `/usr/sbin/netbiosd`. launchd starts it for the system as `com.apple.netbiosd`. Apple lists UDP port 137 for the NetBIOS name service and UDP port 138 for the NetBIOS datagram service. ## Why it uses the network - **Name registration.** It registers the Mac's NetBIOS name on the local network, so Windows computers can find it by name. - **Browsing.** It looks for other computers and workgroups on the network. ## How much is normal Small local traffic is usual. It doesn't use your internet connection. A firewall prompt about incoming connections for `netbiosd` is expected. Windows computers send it name queries. The man page describes only NetBIOS on the local network. ## When it uses a lot, and why - **A busy Windows network.** On an office network with many Windows computers, there are more names to browse and more name queries. ## Is it safe to block? Safe to block Safe to block if you don't share files with Windows computers. It's cleaner to turn off File Sharing, which configures it. What breaks if you block it - Windows computers may not find this Mac by its NetBIOS name. - Browsing Windows computers and workgroups from the Finder may show fewer computers. Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it. ## Reduce its use 1. Check whether you share files. Choose Apple menu › System Settings › General › Sharing. 2. Turn off File Sharing if you don't use it. The `netbiosd` man page says that its configuration comes from the SMB settings. 3. Don't quit `netbiosd` in Activity Monitor. macOS starts it again. ## See how much it uses 1. In Terminal, list its open sockets. Ports 137 and 138 are NetBIOS. ``` sudo lsof -nP -i -a -c netbiosd ``` Needs an administrator password. ## With Kilobat 1. In the Kilobat app list, search for `netbiosd`. Its row shows the live rate and what it moved today. 2. In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online. 3. In Terminal, ask the same question. Add `--json` for scripts and agents. ``` kilobat explain 'netbiosd' ``` 4. Show its traffic over one day. ``` kilobat bandwidth 'netbiosd' day ``` 5. Through MCP, an AI agent asks `explain_connection` with the process name. It gets the same facts. The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the [network filter](https://kilobat.app/docs/blocking#filtering), [Protection](https://kilobat.app/docs/blocking#protection) and the [hotspot data saver](https://kilobat.app/save-hotspot-data). ## What isn’t documented The man page doesn't say when macOS starts `netbiosd` with File Sharing off, or how often it browses. ## Questions **Is netbiosd a virus?** The genuine macOS netbiosd is in `/usr/sbin`, has a man page and is started by launchd. Check the process path and signature if you are unsure. **Does netbiosd send data to the internet?** The man page describes only NetBIOS on the local network. Apple's port list names it for Windows name and datagram services. **Should I allow netbiosd in the firewall?** Allow it if Windows computers need to find this Mac by name. Otherwise, blocking incoming connections is fine. ## Sources - netbiosd(8) and mDNSResponder(8), man pages installed with macOS 27.2 - launchd property list com.apple.netbiosd, macOS 27.2 - [Apple Support: TCP and UDP ports used by Apple software products](https://support.apple.com/en-us/103229) - [Apple Support: Set up file sharing on Mac](https://support.apple.com/guide/mac-help/set-up-file-sharing-on-mac-mh17131/mac) Checked on 1 November 2026. ## Related - [smbd](https://kilobat.app/processes/smbd): Part of macOS. It is the SMB file server for File Sharing, so its traffic is other computers reading and writing this Mac's shared folders. - [mDNSResponder](https://kilobat.app/processes/mdnsresponder): Part of macOS. It handles system DNS lookups for apps and runs Bonjour on the local network, so its traffic can include other apps' name lookups. - [The macOS firewall blocks incoming connections](https://kilobat.app/guides/macos-firewall-incoming) - [Find the devices on your local network from a Mac](https://kilobat.app/guides/find-devices-on-network)