5353

Port 5353/tcp is registered with IANA as mdns with the description "Multicast DNS," assignee [IESG], contact [IETF_Chair], and reference [RFC6762] (dual-registered identically on TCP and UDP). The protocol it serves — Multicast DNS, specified in RFC 6762 (Stuart Cheshire and Marc Krochmal, IETF, February 2013) — provides zero-configuration hostname resolution and, paired with DNS-Based Service Discovery (DNS-SD, RFC 6763), service discovery on a local link without any conventional unicast DNS server. In normal operation a host sends DNS-format queries to the IPv4 multicast group 224.0.0.251 (or the IPv6 group ff02::fb) on UDP port 5353, and every mDNS-capable peer whose hostname or advertised service (_http._tcp, _ipp._tcp, etc.) matches the query answers. The packet format reuses RFC 1035 DNS messages, which is why the same port carries both the resolver and the service-discovery enumerator. Although IANA registers both transports for completeness, operationally mDNS is a UDP protocol; the TCP registration is essentially never used as a service. mDNS is what powers Apple Bonjour (the macOS/iOS mDNSResponder daemon), Avahi on Linux, the native mDNS stack in Windows 10 1903 and later, plus Chromecast, Sonos, AirPrint, and broad IoT advertisement. For an analyst the security relevance is in exposure: mDNS is designed for link-local use and must not answer unicast queries from off-subnet, yet misconfigured devices that do reply externally leak hostname, OS, device model, and service inventory to scanners (Shodan routinely surfaces them) and can be abused as DDoS reflection/amplification vectors — the NCSC-IE advisory documents an amplification factor up to roughly 9.5x (a 45-byte query eliciting a 428-byte response), and INCIBE-CERT has documented DrDoS attacks riding the protocol. Recent Apple mDNSResponder CVEs include CVE-2024-44183 (a logic-error denial of service) and CVE-2025-31222 (local privilege escalation); standard mitigation is to filter inbound/outbound 5353 at the perimeter and confine mDNS to the local link.

IANA assignment

mdns — "Multicast DNS"; reference [RFC6762]; assignee [IESG]; contact [IETF_Chair]; dual-registered 5353/tcp + 5353/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

registered (1024–49151)

Related ports

53 (unicast DNS); 1900/udp (SSDP, another link-local discovery protocol); 137 (NetBIOS name service)

Primary use

Multicast DNS — zero-configuration link-local hostname resolution and service discovery (with DNS-SD, RFC 6763); operationally a UDP protocol though IANA registers TCP for completeness

Other/unofficial uses

DNS-Based Service Discovery (DNS-SD, RFC 6763) shares the same port to enumerate service types (e.g. _http._tcp, _ipp._tcp)

Common software

Apple Bonjour (mDNSResponder on macOS/iOS); Avahi (Linux); native Windows 10 1903+ mDNS stack; Chromecast, Sonos, AirPrint, general IoT advertisement

Security implications

link-local-only by design; externally responsive devices leak hostname/OS/device model/service inventory to scanners (Shodan) and serve as DDoS reflection/amplification vectors (NCSC-IE: ~9.51x, 45-byte → 428-byte; INCIBE-CERT DrDoS). Recent mDNSResponder CVEs: CVE-2024-44183 (DoS), CVE-2025-31222 (local privilege escalation). Mitigation: filter 5353 at the perimeter; confine to link-local

Typically seen on

macOS/iOS, Linux desktops, printers, smart-home/IoT devices on local subnets; an externally reachable 5353 responder is a misconfiguration

Analyst note

A 5353 responder reachable from off-subnet is a misconfiguration worth flagging — it both leaks device fingerprints and can be conscripted into reflection DDoS.

Port 5353/udp is registered with IANA as mdns with the description "Multicast DNS," assignee [IESG], contact [IETF_Chair], and reference [RFC6762] (dual-registered on TCP and UDP). The protocol is Multicast DNS, defined in RFC 6762 (Cheshire & Krochmal, Apple, February 2013): hosts send ordinary DNS-style queries and responses over UDP to the link-local multicast group 224.0.0.251 (IPv4) or FF02::FB (IPv6) on port 5353, resolving .local hostnames and advertising services without any traditional unicast DNS server. It is the transport layer beneath DNS-SD (DNS-Based Service Discovery, RFC 6763) and is the protocol behind Apple Bonjour and the open-source Avahi stack. Because it is zero-configuration, mDNS is built into macOS, iOS, Windows (via Bonjour Print Services), Linux/BSD (Avahi + nss-mdns), ChromeOS, Android (NSD API), and a large population of IoT devices, printers, Chromecast/AirPlay endpoints, and smart-home gear. The reason port 5353 matters for an analyst is exposure: mDNS is designed for link-local scope only — RFC 6762 requires implementations to send with TTL 255 and ignore responses originating outside the local link — yet misconfigured hosts that answer unicast queries on 5353/udp from the public internet are routinely catalogued by internet-wide scanners. Exposed responders leak device metadata (hostnames, model numbers, OS versions, and the full service list), which aids reconnaissance and lateral-movement mapping, and they are abused for DDoS reflection/amplification: Ireland's NCSC documents a real-world amplification factor up to roughly 9.5x (a 45-byte query eliciting a 428-byte response), while Vercara/UltraDNS reports a wider 130%–975% range and over 100,000 vulnerable devices identified globally. The SANS Internet Storm Center tracks port 5353 scanning continuously, and Germany's BSI/CERT-Bund publishes remediation guidance for openly accessible mDNS services. Recent implementation CVEs include CVE-2024-44183 (Apple mDNSResponder local denial of service, patched late 2024) and CVE-2025-31222 (local privilege escalation via mDNSResponder, patched 2025). The recommended perimeter posture is to block inbound and outbound 5353/udp at the network edge and permit it only within the local broadcast domain.

IANA assignment

mdns — "Multicast DNS"; reference [RFC6762]; assignee [IESG]; contact [IETF_Chair]; dual-registered 5353/tcp + 5353/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)

Range class

registered (1024–49151)

Registration / modification date

blank in the IANA registry — not cited [Unknown] — the IANA Service Name and Transport Protocol Port Number Registry (Registration Date and Modification Date columns empty)

Related ports

53 (unicast DNS), 5355 (LLMNR), 1900 (SSDP/UPnP discovery), 137 (NetBIOS name service) — the local name-resolution / service-discovery cluster

Primary use

Multicast DNS (mDNS) — zero-configuration .local name resolution and service discovery on a local link; UDP DNS-style queries/responses sent to link-local multicast 224.0.0.251 / FF02::FB; transport beneath DNS-SD

Common software

Apple Bonjour / mDNSResponder (macOS, iOS, Windows via Bonjour Print Services); Avahi + nss-mdns (Linux, BSD); built into ChromeOS, Android (NSD API), Chromecast/AirPlay, AirPrint printers, Sonos, and many IoT devices

Security implications

internet-exposed responders are abused for DDoS reflection/amplification (NCSC ~9.5x; Vercara 130%–975%, 100,000+ devices) and leak device metadata for recon/lateral movement; SANS ISC tracks 5353 scanning; BSI/CERT-Bund publishes remediation guidance

Notable CVEs

CVE-2024-44183 (Apple mDNSResponder local DoS, patched late 2024); CVE-2025-31222 (mDNSResponder local privilege escalation, patched 2025)

Multicast addresses

224.0.0.251 (IPv4 link-local), FF02::FB (IPv6 link-local) [Confirmed] — RFC 6762

Scope / design intent

link-local only; RFC 6762 mandates TTL 255 and ignoring off-link responses [Confirmed] — RFC 6762

Recommended posture

block inbound and outbound 5353/udp at the network edge; permit only within the local broadcast domain