Share via

LLMNR Problem

Juan Da Loca Loca 0 Reputation points
2024-01-31T20:26:45.3633333+00:00

It's been hard you guys, I've been working day and night trying to find an answer to this. LLMNR is an old, vulnerable name resolution protocol I've been writing an assay about. I'm trying to find the layer of the protocol and I AM CONFUSED! The internet says it's a data-link layer protocol but it uses a UDP based port (5355).

  1. The first question is: why is UDP used in a protocol that never leaves the LAN?
  2. The second is: Which OSI layer is it???
Not Monitored
Not Monitored
Tag not monitored by Microsoft.
37,798 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2024-01-31T21:55:45.3733333+00:00

    LLMNR = Link Local Multicast Name Resolution. You only get multicast with UDP, it's not available via TCP.
    Since it acts like mDNS, it goes in the application layer.

    0 comments