Multicast DNS

Multicast DNS (mDNS) is a protocol that enables devices on the same local network to discover each other without the need for a central DNS server. It is commonly used in home and small office networks to facilitate the discovery of services like printers and file shares. mDNS operates on port 5353 and is part of the Zeroconf suite of protocols.

What is Multicast DNS

Multicast DNS (mDNS) is a protocol designed to resolve hostnames to IP addresses within small networks that do not include a local name server. It is part of the Zeroconf suite of protocols, which aim to simplify network configuration and service discovery. mDNS operates on port 5353 and uses multicast to broadcast DNS queries to all devices on the local network.

mDNS is particularly useful in environments where devices need to discover each other without manual configuration. For example, it is commonly used in home networks to allow computers, printers, and other devices to find each other and communicate seamlessly. Apple’s Bonjour service is a well-known implementation of mDNS, widely used in macOS and iOS devices.

Despite its convenience, mDNS can pose security risks if not properly managed. Since it broadcasts queries to all devices on the local network, it can be exploited for network reconnaissance by malicious actors. Therefore, it is crucial to implement proper network segmentation and security measures to mitigate these risks.

Multicast DNS runs on TCP and UDP port 5353 and is official IANA port.

Security risk

If port 5353 is open and mDNS is running, it can expose the network to potential reconnaissance attacks. Malicious actors can exploit mDNS to gather information about devices and services on the network. Proper network segmentation and security measures are essential to mitigate these risks.

In our UFW tutorial you can follow instructions how you can configure UFW to close port 5353. Use StackChanges to monitor if the Multicast DNS port is closed and stays closed. StackChanges will send an alert if port 5353 is open again.