5353/UDP Multicast DNS (mDNS) and DNS-SD

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

Basic Information

Multicast DNS (mDNS) enables DNS-like operations within local networks without needing a traditional DNS server. It operates on UDP port 5353 and allows devices to discover each other and their services, commonly seen in various IoT devices. DNS Service Discovery (DNS-SD), often used alongside mDNS, aids in identifying services available on the network through standard DNS queries.

5353/udp open  zeroconf

Operation of mDNS

In environments without a standard DNS server, mDNS allows devices to resolve domain names ending in .local by querying the multicast address (IPv4) or FF02::FB (IPv6). Important aspects of mDNS include a Time-to-Live (TTL) value indicating record validity and a QU bit distinguishing between unicast and multicast queries. Security-wise, it's crucial for mDNS implementations to verify that the packet's source address aligns with the local subnet.

Functioning of DNS-SD

DNS-SD facilitates the discovery of network services by querying for pointer records (PTR) that map service types to their instances. Services are identified using a _<Service>._tcp or _<Service>._udp pattern within the .local domain, leading to the discovery of corresponding SRV and TXT records which provide detailed service information.

Network Exploration

nmap Usage

A useful command for scanning the local network for mDNS services is:

nmap -Pn -sUC -p5353 [target IP address]

This command helps identify open mDNS ports and the services advertised over them.

Network Enumeration with Pholus

To actively send mDNS requests and capture traffic, the Pholus tool can be utilized as follows:

sudo python3 pholus3.py [network interface] -rq -stimeout 10


Exploiting mDNS Probing

An attack vector involves sending spoofed responses to mDNS probes, suggesting that all potential names are already in use, thus hindering new devices from selecting a unique name. This can be executed using:

sudo python pholus.py [network interface] -afre -stimeout 1000

This technique effectively blocks new devices from registering their services on the network.

In summary, understanding the workings of mDNS and DNS-SD is crucial for network management and security. Tools like nmap and Pholus offer valuable insights into local network services, while awareness of potential vulnerabilities helps in safeguarding against attacks.


The most interesting attack you can perform over this service is to perform a MitM in the communication between the client and the real server. You might be able to obtain sensitive files (MitM the communication with the printer) of even credentials (Windows authentication). For more information check:

pageSpoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks


Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

Last updated