Even though my network has NetBIOS disabled in my Windows environment, including on the Windows DHCP server, the Mac OS X computers on the network still want to send NetBIOS requests. While monitoring network traffic using tools like Responder in Kali Linux or Wireshark, you can see the NetBIOS requests being sent. In my case, I noticed the requests were being sent every time a file share was being accessed, and only when the hostname was being used instead of the FQDN (Fully Qualified Domain Name).
How To Disable NetBIOS on MacOS OS X
While browsing the internet, I found a few suggestions for how to disable NetBIOS on Mac OS X. While most of them stopped the NetBIOS Daemon, I was still able to observe NetBIOS requests when a Mac tried to browse to an SMB Windows file share. I was finally able to piece together this Terminal command (you’ll need admin rights):
printf "[default]\nport445=no_netbios\n" | sudo tee /etc/nsmb.conf >/dev/null
This will create an nsmb.conf file that will disable NetBIOS when using SMB. I have used this command on MacOS El Capitan and MacOS Sierra.
If you prefer to edit the file yourself, you can use these commands to edit it using the VIM Terminal text editor:
sudo vim /private/etc/nsmb.conf
Control+A - Add the 2 lines below:
[default]
port445=no_netbios
Esc
:wq
The other Terminal commands I found were:
sudo launchctl disable system/netbiosd
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.netbiosd.plist
sudo launchctl unload -w /System/Library/LaunchAgents/com.apple.netbiosd.plist
After doing a combination with all of the above commands, I was able to successfully stop all NetBIOS requests from the Macbooks on our network.
Correction: “sudo vim /private/etc/nsmb.conf” should be “sudo /etc/nsmb.conf”. See also “man nsmb.conf”. After adding the file to /etc I find netbiosd is still running, though I have not tried a restart yet.