Port reference
Port 5355 (UDP) – LLMNR
LLMNR — a Windows fallback name-resolution protocol used when DNS fails on the local link.
Quick facts
- Transport
- udp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Enabled by default on Windows clients. Listens on UDP 5355 and responds to multicast name queries, making it ideal for poisoning.
What is port 5355 used for?
Port 5355 carries LLMNR (Link-Local Multicast Name Resolution), a Windows fallback that resolves hostnames by asking other machines on the local link when normal DNS has no answer. It kicks in for things like mistyped names or stale share paths. It is built into Windows clients and servers and is enabled by default, working alongside the older NetBIOS name service (NBT-NS) on port 137.
When would you open it?
LLMNR works automatically on the local network and needs no firewall changes to function. In practice most administrators do the opposite and turn it off, because reliable DNS makes the fallback unnecessary and it is better left disabled.
Is it safe to open?
LLMNR lets any machine answer name queries, which attackers abuse to capture Windows credentials, so disabling it is the common recommendation. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5355
nmap -sU -p 5355 <target>netstat -ano | findstr :5355
Test-NetConnection <host> -Port 5355 # TCP onlylsof -i :5355
nmap -sU -p 5355 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5355 to your device's local IP, internal port 5355, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5355/udpsudo firewall-cmd --permanent --add-port=5355/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 5355 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5355" -Direction Inbound -Protocol UDP -LocalPort 5355 -Action AllowSecurity & risks
Common attacks
- LLMNR/NBT-NS poisoning with Responder to capture NTLM hashes
- Offline cracking of captured NetNTLMv1/v2 challenge-responses
- NTLM relay of poisoned authentication to SMB or LDAP
- Man-in-the-middle of mistyped or failed hostname lookups
Hardening
- Disable LLMNR via Group Policy (Turn off multicast name resolution)
- Disable NetBIOS over TCP/IP (NBT-NS) on all interfaces
- Ensure DNS is correctly configured so fallback is never needed
- Enforce SMB signing and LDAP signing to break relay
- Alert on rogue LLMNR responders and Responder-style activity
How to block this port
sudo ufw deny 5355/udpsudo firewall-cmd --permanent --remove-port=5355/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 5355 -j DROPNew-NetFirewallRule -DisplayName "Block 5355" -Direction Inbound -Protocol UDP -LocalPort 5355 -Action Blocknmap snippet
nmap -sU -p5355 --script llmnr-resolve <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 5355 used for?
- Port 5355 is LLMNR, a Windows fallback that resolves hostnames by multicast when DNS has no answer. It lets nearby hosts reply with the address for a requested name.
- Why should I disable LLMNR?
- Because any host can answer an LLMNR query, an attacker running Responder claims to be the requested name, captures the victim's NTLM hash, and cracks or relays it. Disabling LLMNR removes the vector.