{
  "port": 5353,
  "protocol": "udp",
  "service": "mDNS (Bonjour / Avahi)",
  "oneLiner": "Multicast DNS — how machines find each other by name on a LAN with no DNS server.",
  "whatItIs": "mDNS resolves .local names and carries DNS-SD service discovery over multicast to 224.0.0.251 (FF02::FB on IPv6). It is running on essentially every Mac, iPhone, Android device, Linux box with Avahi, printer, and Chromecast on the network — the daemon is mDNSResponder on Apple platforms and avahi-daemon elsewhere. It appears on a scan because the responder binds UDP 5353 and will also answer unicast queries sent to that port.",
  "exposure": {
    "verdict": "never",
    "note": "Reachable from the internet it both leaks a device inventory (hostnames, service records, sometimes usernames) and works as a reflection/amplification source; on a trusted LAN it is normal and expected."
  },
  "checkCommand": "dig +short @224.0.0.251 -p 5353 -t ptr _services._dns-sd._udp.local",
  "links": [
    {
      "title": "RFC 6762 — Multicast DNS",
      "url": "https://datatracker.ietf.org/doc/html/rfc6762",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 5353",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5353",
      "kind": "iana"
    },
    {
      "title": "apple-oss-distributions/mDNSResponder",
      "url": "https://github.com/apple-oss-distributions/mDNSResponder",
      "kind": "github"
    },
    {
      "title": "Apple — TCP and UDP ports used by Apple software products",
      "url": "https://support.apple.com/en-us/103229",
      "kind": "official-docs"
    }
  ]
}