Port 5355 (LLMNR)

Link-Local Multicast Name Resolution, a Windows fallback when DNS fails.

Registered (user) port, 1024-49151 UDPTCP Windows networking Localhost or LAN only

What port 5355 is used for

Link-Local Multicast Name Resolution, a Windows fallback when DNS fails.

Localhost or LAN only. Disable it with Group Policy where possible: attackers on the LAN answer LLMNR queries (Responder) to capture NTLM hashes.

Service nameProtoDescriptionAssigneeReference

llmnr TCP LLMNR Bernard Aboba -

llmnr UDP LLMNR Bernard Aboba -

Registry dates for this port: registered 2004-06.

Linux: is anything listening on TCP 5355?

sudo ss -tlnp 'sport = :5355'

Linux: UDP 5355

sudo ss -ulnp 'sport = :5355'

Linux / macOS: which process owns the port

sudo lsof -nP -i :5355

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':5355 '

Windows (Command Prompt)

netstat -ano | findstr :5355

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 5355 -State Listen | Select LocalAddress,OwningProcess

From another machine

nc -vz -w 5 HOST 5355

From Windows

Test-NetConnection HOST -Port 5355

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 5355

ufw

sudo ufw deny 5355/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 5355 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 5355 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 5355' -Direction Inbound -Protocol TCP -LocalPort 5355 -Action Block

ufw

sudo ufw deny 5355/udp

iptables

sudo iptables -A INPUT -p udp --dport 5355 -j DROP

nftables

sudo nft add rule inet filter input udp dport 5355 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block UDP 5355' -Direction Inbound -Protocol UDP -LocalPort 5355 -Action Block

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.