whatportis.com
suggest an edit →

Port 5355LLMNR

Link-Local Multicast Name Resolution (LLMNR) is a protocol that enables devices on the same local network segment to perform name resolution without requiring a DNS server. Primarily found in Microsoft environments starting from Windows Vista and Server 2008, LLMNR facilitates communication during network initialization or when DNS is unavailable..

inSecurityNetwork ServicesSystem
transport
tcp · udp

2 transports registered

in transit
cleartext

payload readable on path

assignment
official

registered with iana

risk
4/10

caution

lookups
10,784

rank 403 of 993 · top 41%

Technical Details

what runs on :5355

Overview:

Link-Local Multicast Name Resolution (LLMNR) is a protocol designed to provide name resolution on hosts connected to the same local subnet without relying on external DNS servers. It functions by sending multicast queries to specific IPv4 and IPv6 multicast addresses, enabling devices to resolve each other's names.

Protocol Details:

LLMNR operates over both TCP and UDP on port 5355. It uses multicast address 224.0.0.252 (IPv4) or FF02::1:3 (IPv6) to transmit queries to all local hosts. If a device recognizes the queried name as its own, it responds directly to the querying host. Thus, LLMNR supports peer-to-peer name resolution in small, unmanaged or transient networking environments.

Deployment Context:

LLMNR is enabled by default on many Windows-based systems, especially within workgroup settings without centralized DNS infrastructure. It can assist during network bootstrapping or for temporary ad-hoc communications. However, in managed or enterprise environments, proper DNS use is preferred, and LLMNR is often disabled for security reasons.

Security Information

exposure of :5355

risk score

4/ 10caution

worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.

security averages 3.8 across 216 ports — this one sits 0.2 above.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

official

registered with iana for this service — scanners fingerprint it by number

reachable over

tcp · udp

udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite

security overview

Common Vulnerabilities:

  • Susceptibility to Poisoning: Attackers within the local network segment can impersonate legitimate hosts by responding to multicast LLMNR queries, redirecting traffic or harvesting credentials (similar to NetBIOS poisoning attacks).
  • Credential Theft: Malicious actors exploit LLMNR responses by capturing NTLM hashes during authentication attempts, which can then be cracked offline.
  • Man-in-the-Middle Attacks: Successfully poisoned responses can enable interception or modification of data during authentication or service access.

Common Mitigations:

  • Disable LLMNR: The most effective mitigation is disabling LLMNR via Group Policy (Turn Off Multicast Name Resolution) where not explicitly needed.
  • Implement Network Segmentation: Restrict local network exposure and limit broadcast/multicast domains to reduce the attack surface.
  • Use Strong Authentication: Enforce multifactor authentication and avoid NTLM where possible to minimize mitigation impact.
  • Monitor and Detect: Deploy network intrusion detection systems (IDS) capable of identifying LLMNR poison attempts and anomalous LLMNR traffic.

Related Ports

all 216 in security →

the 8 most looked-up other ports in security — 216 ports carry that label.

portservicerisk
:8881Atlasz Secure Servercaution
:443HTTPScaution
:8291Winbox MikroTik Admincaution
:3268Microsoft Global Catalog (GC)caution
:135Microsoft EPMAPcaution
:3128Squid Proxy HTTPcaution
:8080HTTP Alternatecaution
:7000Vuze HTTPS Trackercaution

risk mix of the 8 listed

  • caution100%

3 of 8 encrypted