Skip to main content
protocols.pageprotocols.page
5353

Port 5353 – mDNS

UDP

Port 5353 is the mDNS (Multicast DNS) port for zero-configuration name resolution on local networks. mDNS resolves .local hostnames without a DNS server – Apple Bonjour, Linux Avahi, and Windows use it for printer discovery, AirPlay, and device naming. mDNS has no authentication and should never traverse network boundaries.

Port Number

5353

Protocol

UDP

Service

Multicast DNS

Range

IANA Registered (1024–49151)

Description

Multicast DNS on UDP port 5353 enables hostname resolution on local networks without infrastructure DNS servers. Devices announce themselves (myprinter.local) by sending multicast packets to 224.0.0.251 (IPv4) or ff02::fb (IPv6) on port 5353. Other devices on the same broadcast domain receive these announcements. mDNS powers Apple Bonjour (AirPlay, AirPrint, HomeKit), Linux Avahi service discovery, and Windows Link-Local Multicast Name Resolution. The protocol has no authentication – any device on the network can claim any .local name, enabling spoofing attacks. Network segmentation (VLANs) is the primary defense. mDNS traffic should never be routed between subnets unless specifically intended via an mDNS reflector/gateway.

Security risks

  • 1CVE-2020-3221: Cisco IOS mDNS gateway DoS – crafted mDNS packets crash the device (CVSS 8.6, affects enterprise switches and wireless controllers)
  • 2DDoS amplification: mDNS responds to unicast queries from any source (RFC allows it) with amplification factor of 2-10x. Over 300,000 exposed mDNS responders used in reflection attacks
  • 3Network reconnaissance: mDNS responses reveal all advertised services on the network – printers, file shares, AirPlay devices, SSH servers, web services – complete topology mapping
  • 4Spoofing/poisoning: mDNS has no authentication – any device on the network can claim any .local name, redirecting traffic intended for legitimate services (ARP poisoning equivalent for names)
  • 5Cross-VLAN leakage: misconfigured switches or mDNS gateways/reflectors can leak .local discovery across VLANs, exposing IoT devices and services to untrusted network segments

Firewall guidance

mDNS uses multicast (224.0.0.251:5353) and is link-local by design – it should not cross network boundaries. Block UDP 5353 at router/L3 interfaces to prevent cross-subnet leakage. On servers: disable avahi-daemon if not needed (systemctl disable avahi-daemon). Do NOT enable mDNS gateways/reflectors unless you specifically need cross-VLAN service discovery (and understand the security implications).

Diagnosis commands

Linux: browse all mDNS services on the local network

shell
avahi-browse -a -t

macOS: browse all advertised service types

shell
dns-sd -B _services._dns-sd._udp local.

Capture mDNS traffic to see what's being advertised

shell
tcpdump -i eth0 -n udp port 5353 -c 10

Check if mDNS responder is running on Linux

shell
systemctl status avahi-daemon

Usage examples

Port 5353 – mDNS
shell
avahi-browse -at
dns-sd -B _http._tcp local.
mdns-scan
dig @224.0.0.251 -p 5353 myhost.local

Common services on this port

Avahi (Linux)Bonjour (macOS/iOS)Windows mDNS responderChromebook mDNSIoT devices (ESP32, smart home)

Related ports

5353

mDNS (this port, UDP multicast)

5355

LLMNR (Windows local name resolution)

53

DNS (unicast name resolution)

1900

SSDP/UPnP (device discovery)

History

mDNS (Multicast DNS) was standardized in RFC 6762 (2013) by Stuart Cheshire (Apple), building on Apple's Bonjour/Rendezvous technology from 2002. Port 5353/UDP with multicast address 224.0.0.251 was assigned. mDNS enables zero-configuration networking: devices automatically discover each other without a DNS server. It powers: AirPrint, AirPlay, Chromecast discovery, Spotify Connect, and most IoT device setup flows.

FAQ

How do I disable mDNS on Linux servers?

systemctl disable --now avahi-daemon avahi-daemon.socket. If you need local hostname resolution without mDNS: use systemd-resolved with LLMNR only, or configure static /etc/hosts entries. Verify: ss -ulnp | grep 5353 should show nothing. For Docker hosts: containers may run their own mDNS – check with docker exec <container> ss -ulnp | grep 5353.

mDNS vs LLMNR vs DNS-SD?

mDNS (port 5353): Apple/Linux, resolves .local names, also does service discovery (via DNS-SD). LLMNR (port 5355): Microsoft, resolves flat names (no .local suffix), Windows-only in practice. DNS-SD: not a protocol itself but a specification (RFC 6763) for structuring service discovery records – runs OVER mDNS or unicast DNS. In practice: Apple uses mDNS, Windows uses LLMNR (and increasingly mDNS since Windows 10), Linux uses Avahi (mDNS).

Specification

RFC 6762 – Port 5353 specification →