What does address 224.0.0.251:5353 represent?

Question

I read some tutorials,they say that netstat is deprecated. I tried ss command. THis is the output

Netid           State            Recv-Q            Send-Q                       Local Address:Port                        Peer Address:Port           Process           
icmp6           UNCONN           0                 0                                        *:58                                     *:*                                
udp             UNCONN           0                 0                              224.0.0.251:5353                             0.0.0.0:*                                
udp             UNCONN           0                 0                              224.0.0.251:5353                             0.0.0.0:*                                
udp             UNCONN           0                 0                              224.0.0.251:5353                             0.0.0.0:*                                
udp             UNCONN           0                 0                              224.0.0.251:5353                             0.0.0.0:*                                
udp             UNCONN           0                 0                                  0.0.0.0:5353                             0.0.0.0:*                                
udp             UNCONN           0                 0                                  0.0.0.0:40886                            0.0.0.0:*                                
udp             UNCONN           0                 0                            127.0.0.53%lo:53                               0.0.0.0:*                                
udp             UNCONN           0                 0                                  0.0.0.0:631                              0.0.0.0:*                                
udp             UNCONN           0                 0                                  0.0.0.0:17500                            0.0.0.0:*                                
udp             UNCONN           0                 0                                     [::]:5353                                [::]:*                                
udp             UNCONN           0                 0                                     [::]:55606                               [::]:*                                
udp             UNCONN           0                 0                                        *:41016                                  *:*                                
udp             UNCONN           0                 0                                        *:1716                                   *:*

ss -at at port 5353 shows

ss -aut '( dport = :5353 or sport = :5353 )'
Netid           State             Recv-Q            Send-Q                       Local Address:Port                       Peer Address:Port           Process           
udp             UNCONN            0                 0                              224.0.0.251:mdns                            0.0.0.0:*                                
udp             UNCONN            0                 0                              224.0.0.251:mdns                            0.0.0.0:*                                
udp             UNCONN            0                 0                              224.0.0.251:mdns                            0.0.0.0:*                                
udp             UNCONN            0                 0                              224.0.0.251:mdns                            0.0.0.0:*                                
udp             UNCONN            0                 0                              224.0.0.251:mdns                            0.0.0.0:*                                
udp             UNCONN            0                 0                                  0.0.0.0:mdns                            0.0.0.0:*                                
udp             UNCONN            0                 0                                     [::]:mdns                               [::]:*

Can someone explain how to interpret it?

You're looking at UDP ports in the `netstat` output, but you don't include `-u` in the `ss` command (but `-t` for TCP ports, so I assume you know what you're doing). Is that intentional? Port 5353 is generally a MDNS responder, having to do with host name lookups (see `grep '^mdns' /etc/services`). — Kusalananda, Mar 09 '21 at 09:29
@Kusalananda Thanks.I have not seen it before. Who created it? I have not added any printers nor installed anything new to Ubuntu 20.04. — TrajcheS, Mar 09 '21 at 09:38
Check `sudo lsof -i :mdns`. You'll see an `avahi-daemon` process. — Kusalananda, Mar 09 '21 at 09:46

score 4 · Accepted Answer · answered Mar 09 '21 at 09:29

224.0.0.251 is Multicast DNS, and it use the port 5353 (as you noticed). Many operating systems use it to discover new devices/printers/routers with zero or nearly zero configuration. E.g. if you want to send a page to be print to your printer, with e.g. the address my-printer.local, your operating system uses such port to look for the device which is named my-printer

What does address 224.0.0.251:5353 represent?

1 Answers1