Port 5353 mDNS – Free, Online, Private

What listens on 5353

Port 5353 is mDNS. The IANA name is mdns, Multicast DNS, RFC 6762. A host asks for names ending in .local by sending a UDP query to the multicast group 224.0.0.251, or FF02::FB on IPv6, with destination port 5353. Responders answer from 5353. There is no central server. The IANA registry also has a TCP row. The protocol you can capture on a LAN is UDP. Avahi, systemd-resolved, and Apple's mDNSResponder are the usual processes. Unicast DNS is port 53. Treating a .local name as a DNS name and sending it to 53 fails in a way that looks like a resolver outage.

The IANA service name is mdns: Multicast DNS. The practical transport is UDP. The checks below use UDP. A UDP socket has no listen state in the TCP sense, so lsof will not show -sTCP:LISTEN and nc cannot complete a handshake. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 5353

Service notes for port 5353: the IANA name is mdns (Multicast DNS), and the program people mean is mDNS. UDP 5353 is the IANA mdns port, multicast DNS, RFC 6762. Queries go to 224.0.0.251, not to a unicast server. TCP 5353 is registered and is not the traffic. mDNS announces names and services to the local link. On a conference network that is a leak of host names and sometimes of service ports. Disable it on servers and on laptops that join untrusted networks, or firewall UDP 5353 off those interfaces. Do not reflect mDNS across subnets unless you mean to. A responder that answers for a name it does not own is a spoof, and the protocol does not authenticate the answer. For anything that matters, use unicast DNS with DNSSEC, not .local. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 5353, you are on the wrong page.

A host with two interfaces answers on the wrong one, so a printer is visible on the office VLAN and not on the guest VLAN, or the reverse. Another trap is Docker and systemd-resolved both interested in 53 while mDNSResponder holds 5353, and someone 'fixes' the wrong port. Another is a browser or an SSH client appending .local and waiting on a multicast answer that a cloud VPC will never deliver, because multicast is filtered. The timeout is long. Use a real DNS name. Another is IPv6 left on. FF02::FB is a second path.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 5353 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. A UDP socket on 5353 owned by mDNSResponder, avahi-daemon, or systemd-resolved is the local participant. It will not show TCP LISTEN. A packet capture of 224.0.0.251 is the proof. nc to a unicast address on 5353 is the wrong test.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• mDNS is multicast UDP. It is not a second unicast resolver on 5353.
• Port 53 is unicast DNS. .local names do not belong there.
• TCP 5353 in the registry is not the protocol on the wire.
• Multicast does not cross a cloud VPC. A timeout there is expected.

Linuxsudo ss -lpun 'sport = :5353'
sudo lsof -nP -iUDP:5353

macOSsudo lsof -nP -iUDP:5353
netstat -anv -p udp | grep '\.5353[^0-9]'

Windowsnetstat -ano | findstr :5353
Get-NetUDPEndpoint -LocalPort 5353

Remotenc -vzu host 5353