What is netbiosd on Mac, and why is it using the network?

Last updated: 2026-07-31

What it is

netbiosd is the NetBIOS protocol daemon supplied with macOS by Apple. Its executable is located at /usr/sbin/netbiosd, and its verified code-signing identifier is com.apple.netbiosd.

The daemon registers and maintains the Mac’s NetBIOS name. It also browses for names in a workgroup, collects information about compatible hosts, and makes the resulting name information available to the system through mDNSResponder. This places netbiosd in the compatibility and legacy network-discovery side of the SMB stack.

That role is narrower than the name may suggest. netbiosd does not carry the contents of shared files. Actual SMB file sessions are handled elsewhere, and netbiosd does not by itself provide the compatibility fallback to TCP port 139. Its presence therefore means that macOS has a NetBIOS name and discovery component available; it does not mean that a file transfer is taking place.

Why it talks to the network

When the Mac has a default IPv4 route, launchd runs netbiosd and provides it with sockets for UDP port 137, the NetBIOS Name Service, and UDP port 138, the NetBIOS Datagram Service. Network-interface changes or changes to SMB configuration can cause the daemon to update its view of the network.

Depending on the configuration, netbiosd may broadcast on the local network or communicate with a WINS server configured by an administrator. It uses those paths to register the Mac’s NetBIOS name, defend that name, and resolve other NetBIOS names. It also periodically looks for NetBIOS workgroups, browsing hosts, and other compatible devices on the same network.

Most of these exchanges concern short names and discovery records, not user documents. Local NetBIOS nodes and a configured WINS server are the expected communication partners described by its role. Actual SMB file traffic, including modern sessions over TCP port 445, should not be attributed to netbiosd merely because it appears at the same time.

How much traffic is normal

Normal netbiosd activity is qualitatively close to silent or low-volume. Its traffic mainly consists of small name-registration, name-query, and workgroup-browsing messages, so it should ordinarily be much smaller than any real file transfer.

Apple has not published a trustworthy normal byte range for this process. There is therefore no verified number of kilobytes or megabytes that can serve as a universal threshold. The expected volume in a large legacy workgroup, a WINS-based environment, or a situation involving abnormal retries has not been independently verified either. A higher total deserves investigation in context, but the available evidence does not support declaring a specific byte count normal or abnormal for every Mac.

Can you turn it off

netbiosd is optional for a Mac that does not rely on NetBIOS names, WINS, or legacy workgroup discovery. For an ordinary user who has not confirmed those conditions, keeping the system default is the safer choice.

Apple does not provide a switch for netbiosd in System Settings. Apple does document a Terminal-based disabling method for enterprise and education administrators, but there is no System Settings path to give here.

Turning the daemon off removes the Mac’s NetBIOS name registration and defense, along with legacy workgroup browsing and NetBIOS name discovery. Windows computers, Samba servers, NAS devices, and enterprise networks that depend on WINS, short NetBIOS names, or workgroup browsing may then become undiscoverable or unreachable by those short names.

Modern SMB 2 and SMB 3 connections that use DNS and TCP port 445 will usually continue to work. However, stopping netbiosd is not the same as completely disabling SMB 1 or the SMB client’s NetBIOS fallback. Apple documents separate /etc/nsmb.conf settings for those two behaviors.

What people get wrong

• “netbiosd is a virus or third-party telemetry.” The verified /usr/sbin/netbiosd is an Apple platform-signed system daemon, and its code-signing identifier is com.apple.netbiosd. Its appearance in Activity Monitor alone is not a sign that the Mac is infected.

• “netbiosd uploads files or personal data to Apple.” Its documented responsibilities are NetBIOS name registration, resolution, and workgroup browsing. Its expected communication is primarily with NetBIOS nodes on the local network and with an administrator-configured WINS server. It is not the process responsible for transferring shared-file contents.

• “Disabling netbiosd shuts down all SMB and file sharing.” Modern SMB 2 and SMB 3 can continue to connect through DNS and TCP port 445. Disabling SMB 1 or the SMB client’s NetBIOS fallback requires separate configuration described by Apple.

• “Turning off File Sharing in System Settings must stop netbiosd.” That conclusion does not follow. Even when macOS is not accepting incoming SMB connections by default, netbiosd may continue running as a name-registration and browsing service. There is no corresponding netbiosd switch in System Settings.

• “NetBIOS is old, so everyone should disable netbiosd for a noticeable speed improvement.” There is no verified basis for that claim. Under normal conditions, the daemon usually produces only a small amount of control traffic. Disabling it can instead break discovery or short-name resolution for older Windows, Samba, and NAS devices, as well as WINS and enterprise workgroup environments.

Seeing what it actually used

Before changing anything, check netbiosd in Bytetally’s per-process statistics and compare its traffic with the time and network where you noticed it. Look for whether the total stays small or changes after an interface or SMB configuration change. This also helps keep netbiosd control messages separate from the much larger traffic generated by an actual SMB file transfer.

Related processes

Common questions