UDP 5353
Synopsis
- UDP port 5353 is used by Multicast DNS (mDNS) for local service discovery.
- Apple’s Bonjour (mDNSResponder) on macOS and iOS uses 5353 to advertise and find AirPlay, AirPrint, and file-sharing services.
- Avahi on Linux distributions (Ubuntu, Debian, Fedora, RHEL) and systemd-resolved handle mDNS on 5353 for DNS-SD service announcements.
- Windows 10/11 implement mDNS on 5353 for device discovery; browsers like Google Chrome and Microsoft Edge use it to find Google Cast and WebRTC local devices.
- Consumer devices using 5353 include Google Chromecast/Google Home, Sonos speakers, Philips Hue Bridge, Apple HomeKit accessories, and network printers from HP, Epson, and Canon.
- Media and file-sharing apps such as iTunes/Apple Music, AirPlay speakers, and AirPrint printers rely on mDNS over 5353 to be discovered on the LAN.
- Smart-home platforms like Home Assistant and Homebridge use 5353 to advertise integrations and discover devices.
- Security note: Exposed 5353/UDP is often abused for reflection/amplification DDoS and can leak host/service info; mDNS responders (e.g., Apple mDNSResponder, Avahi) have had exploitable vulnerabilities historically.
Observed activity
Last 30 days
Detailed chart