LLMNR Problem

Question

It's been hard you guys, I've been working day and night trying to find an answer to this. LLMNR is an old, vulnerable name resolution protocol I've been writing an assay about. I'm trying to find the layer of the protocol and I AM CONFUSED! The internet says it's a data-link layer protocol but it uses a UDP based port (5355).

1. The first question is: why is UDP used in a protocol that never leaves the LAN?
2. The second is: Which OSI layer is it???

Answer 1

LLMNR = Link Local Multicast Name Resolution. You only get multicast with UDP, it's not available via TCP.
Since it acts like mDNS, it goes in the application layer.