DevToolsmith

Port 5353: mDNS

Port 5353 (UDP) is used by multicast DNS for discovering devices on a local network. It is a registered port (1024–49151), so any user can listen on it.

Service
mDNS
Protocol
UDP
Range
Registered (1024–49151)
Official
IANA-registered
Exposure
Keep private
Category
Network services

What uses port 5353

mDNS (Bonjour on Apple devices, Avahi on Linux) lets devices resolve .local names and advertise services such as printers, AirPlay speakers and Chromecasts without a DNS server, by multicasting to 224.0.0.251:5353. It only works within a single network segment.

Should port 5353 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

  • Devices can’t find each other across VLANs because multicast doesn’t cross routers. An mDNS reflector (Avahi’s enable-reflector, or the router’s mDNS repeater) bridges them.

Check what is listening on port 5353

Linux
sudo ss -lunp 'sport = :5353'
macOS
sudo lsof -nP -iUDP:5353
Windows (PowerShell)
Get-NetUDPEndpoint -LocalPort 5353
netstat -ano | findstr :5353

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Allow port 5353 from trusted networks only

The examples allow 5353 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

Ubuntu / Debian (ufw)
sudo ufw allow from 10.0.0.0/8 to any port 5353 proto udp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 5353 proto udp
RHEL / Fedora / Rocky (firewalld)
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="5353" protocol="udp" accept'
sudo firewall-cmd --reload
Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "mDNS 5353/UDP" -Direction Inbound -Protocol UDP -LocalPort 5353 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 5353 from another machine

macOS / Linux
nc -zvu example.com 5353   # UDP has no handshake, so "open" isn't conclusive

Related ports

  • Port 53 (DNS): used by DNS to translate domain names into IP addresses.
  • Port 137 (NetBIOS Name Service): used by NetBIOS name service for legacy Windows name resolution on local networks.

More network services ports

67 (DHCP server) , 68 (DHCP client) , 88 (Kerberos) , 123 (NTP) , 135 (Microsoft RPC) , 179 (BGP) , 389 (LDAP) , 636 (LDAPS) . See all ports in the port lookup.

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 5353 used for?

Port 5353 is used by multicast DNS for discovering devices on a local network. mDNS (Bonjour on Apple devices, Avahi on Linux) lets devices resolve .local names and advertise services such as printers, AirPlay speakers and Chromecasts without a DNS server, by multicasting to 224.0.0.251:5353. It only works within a single network segment.

Is it safe to open port 5353?

Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.

How do I check if port 5353 is open?

On the server, list listening sockets with "sudo ss -lunp 'sport = :5353'" on Linux or "sudo lsof -nP -i :5353" on macOS. From another machine, UDP has no handshake, so a port scan can’t reliably tell whether it is open; test with a real client for the service instead.