PORTLink-local onlyIANA assigned
Port 5353mDNS (Multicast DNS)
Port 5353 is the UDP port for Multicast DNS (mDNS), which lets devices on a local network find each other by name without a DNS server. Apple Bonjour, Linux Avahi, Windows 10/11, printers, smart TVs and Chromecast all send and listen on UDP 5353 to the multicast address 224.0.0.251.
What port 5353 is used for
Multicast DNS answers the question "what is the IP address of printer.local?" without any DNS server. The querying device sends the question to the multicast group on UDP 5353; the device that owns the name replies to the same group. Combined with DNS-Based Service Discovery (DNS-SD), it also answers "which printers, speakers or file servers are on this network?" That is how AirPrint, AirPlay, Chromecast setup, HomeKit and many smart-home products work.
What you will see on a Windows PC
netstat -ano -p udp | findstr :5353 typically shows svchost.exe (the DNS Client service) and often Chrome or Edge, which use mDNS for casting. Software such as iTunes, Spotify or printer utilities installs Bonjour, which adds mDNSResponder.exe.
Security considerations
- Local link only. mDNS is meant to stop at the router. Block UDP 5353 inbound and outbound at the internet edge.
- Information disclosure. Device names often reveal owners and models. On shared networks (hotels, offices) that is worth knowing.
- Spoofing. Anything on the LAN can answer a
.localquery. Tools exploit this to capture authentication attempts when Windows falls back to LLMNR/mDNS for unknown names. In managed environments, disable mDNS and LLMNR on domain machines and rely on proper DNS.
Firewall considerations
Windows Defender Firewall allows mDNS on the Private profile by default and restricts it on Public. Leave those defaults unless the machine must be invisible on the LAN. Never forward 5353 on a router.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 5353 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
Why is svchost.exe listening on UDP 5353?
Windows 10 and 11 include an mDNS responder in the DNS Client service so that hostname.local names resolve and devices can discover the PC. It is normal and can be disabled through a registry setting (EnableMDNS) if not wanted.
Can mDNS cross subnets?
Not by default; multicast stays on the local link. Enterprises use an mDNS gateway or Bonjour reflector to make printers and cast devices visible across VLANs.
Is port 5353 dangerous?
On a home LAN it is how devices find each other. Exposed to the internet, mDNS responders can be used for reflection attacks and leak device names, so routers and firewalls should never forward it.