Port reference
Port 5353 (UDP) – mDNS
Multicast DNS — resolves hostnames and discovers services on a local network without a DNS server.
Quick facts
- Transport
- udp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open by default on macOS, iOS, Linux (Avahi), Windows, printers, and IoT devices. Should be confined to the local subnet.
What is port 5353 used for?
Port 5353 carries multicast DNS (mDNS), the technology that lets devices find each other and resolve .local names on a home or office network without a DNS server. It powers Apple Bonjour, Avahi on Linux, and the discovery features built into Windows, printers, smart-home gear, and streaming devices. It is how your computer spots a nearby printer, AirPlay speaker, or Chromecast automatically.
When would you open it?
mDNS is meant to stay on your local subnet and normally needs no firewall changes there. You might allow it between VLANs or wireless segments so devices on one network can discover printers or media players on another, but it should never be exposed to the internet.
Is it safe to open?
On the public internet mDNS leaks device details and can be abused for amplification attacks, so keep it confined to trusted local networks. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5353
nmap -sU -p 5353 <target>netstat -ano | findstr :5353
Test-NetConnection <host> -Port 5353 # TCP onlylsof -i :5353
nmap -sU -p 5353 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5353 to your device's local IP, internal port 5353, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5353/udpsudo firewall-cmd --permanent --add-port=5353/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 5353 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5353" -Direction Inbound -Protocol UDP -LocalPort 5353 -Action AllowSecurity & risks
Common attacks
- LAN service, device, and hostname enumeration
- mDNS reflection / amplification DDoS when exposed to the internet
- Spoofing/poisoning of mDNS responses on the local segment
Hardening
- Block UDP 5353 inbound at the internet edge
- Disable mDNS/Bonjour/Avahi where it isn't needed
- Filter mDNS between VLANs; keep it on trusted segments only
- Patch mDNS responders (Avahi, mDNSResponder) against known CVEs
How to block this port
sudo ufw deny 5353/udpsudo firewall-cmd --permanent --remove-port=5353/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 5353 -j DROPNew-NetFirewallRule -DisplayName "Block 5353" -Direction Inbound -Protocol UDP -LocalPort 5353 -Action Blocknmap snippet
nmap -sU -p5353 --script dns-service-discovery <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 5353 used for?
- UDP 5353 carries multicast DNS (mDNS), the basis of Apple Bonjour and Avahi. It lets devices resolve .local names and advertise services like printers and AirPlay without a DNS server.
- Is mDNS a security risk on the internet?
- Yes. mDNS is meant for the local subnet; if a device answers mDNS from the internet it leaks device details and can be abused as a reflection/amplification DDoS source.