Port 5353Multicast DNS
Port 5353 (UDP) is multicast DNS (mDNS, RFC 6762): devices answer .local name queries sent to 224.0.0.251 or ff02::fb. It is how printers, Chromecast, AirPlay, Bonjour and Avahi services are found on a LAN. Seeing it in a firewall log is normal, since browsers and the Windows DNS Client listen on it. Blocking it inside the LAN breaks discovery, so block it at the internet edge only.
- transport
- udp
- in transit
- cleartext
- assignment
- official
- risk
- 2/10
- lookups
- 13,394
single transport
payload readable on path
registered with iana
safe
rank 273 of 6,669 · top 4%
also known as mdns, Multicast DNS (mDNS), Bonjour, Avahi
Technical Details
what runs on :5353Multicast DNS (mDNS) is a protocol designed for resolving hostnames to IP addresses within small networks that lack a dedicated DNS server. This is accomplished by leveraging multicast UDP packets sent to all devices on the local subnet using the reserved address 224.0.0.251 on UDP port 5353. When a device queries for a hostname, it multicasts the request, and the target system responds directly if it owns the address.
mDNS is a core component of Zero-Configuration Networking (ZeroConf), popularly implemented in Apple's Bonjour service. It cooperates with DNS Service Discovery (DNS-SD) to offer a combined solution for locating network services like printers, file sharing, or media streaming devices without manual configurations or infrastructure.
Technically, mDNS reuses much of the classic DNS packet structure and semantics but restricts query scope by sending messages to a multicast address. Consequently, it reduces the need for centralized management in small or dynamic environments. However, as it relies heavily on multicast, its operation is bounded to the local subnet and not suitable for wide-area resolution.
Who is listening
Several programs can share UDP 5353: the DNS Client service on Windows (inside svchost), Chromium-based browsers, mDNSResponder on macOS and avahi-daemon on Linux. On Windows, Get-NetUDPEndpoint -LocalPort 5353 lists the owning processes.
Discovery across VLANs
mDNS doesn't cross subnets. To reach a Chromecast or AirPlay device on another VLAN, run an mDNS reflector or repeater, such as Avahi with enable-reflector=yes or the equivalent feature on the router.
Security Information
exposure of :5353risk score
2/ 10safe
routine exposure. this port is rarely the way in on its own — keep it patched and logged and move on.
network services averages 2.6 across 2,027 ports — this one sits 0.6 below.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
official
registered with iana for this service — scanners fingerprint it by number
reachable over
udp
udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite
security overview
Common vulnerabilities:
- Susceptibility to spoofing attacks where malicious devices respond with forged answers, potentially redirecting traffic.
- Potential information leakage, as hostname and service details are broadcasted to all devices on the subnet.
- Possible amplification vector for DDoS attacks through spoofed multicast queries that elicit numerous responses.
Common mitigations:
- Segmenting networks with VLANs or firewall rules to limit the multicast domain.
- Adding filtering rules on switches or routers to restrict or control mDNS traffic.
- Disabling mDNS on sensitive or unmanaged devices to minimize exposure.
- Implementing monitoring solutions to detect abnormal multicast traffic patterns indicating misuse.
Internet exposure
- Responders that answer queries from outside the local link leak device and service details and can be used for DDoS amplification (CERT VU#550620, CVE-2015-2809). Block inbound UDP 5353 at the WAN.
Related Ports
the 8 most looked-up other ports in network services — 2,027 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :9080 | Groove RPC | TCPUDP | Web Services | caution | 70.8k |
| :6543 | Jetnet | UDP | Network Services | caution | 65.3k |
| :5938 | TeamViewer | TCPUDP | Remote Access | caution | 65.0k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3233 | WhiskerControl Protocol | TCPUDP | Network Services | caution | 61.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Tatsoft Default HTTP Proxy | TCP | Web Services | caution | 46.8k |
risk mix of the 8 listed
- caution100%
0 of 8 encrypted