Disable mDNS

Question

Disable mDNS

Anonymous

Hi, I understnad that mDNS works in small networks when there is no DNS servers which is not the case in my networks. I have a win AD with DNS. Recently, while I was in a wirshark session, I noticed recently, that different devices in my network flooding the network with mDNS messages every 60 seconds or less as you can notice in the snapshot. I have the service Dnscache/DNS client always running but no registry key. So 1st question, if it is a cache service, why devices are sending this? 2nd q, how can I disable it as I have a DNS server? ![40714-mdns.jpg][1] [1]: /api/attachments/40714-mdns.jpg?platform=QnA

Anonymous

2020-11-18T11:09:29.627+00:00

Also, can somebody tell me where does eliassal.local come from, it seems that it is a like a host from DNS but I have no machines with such name

Answer accepted by question author

Anonymous

You could set this one to Enabled
If you enable this policy setting, LLMNR will be disabled on all available network adapters on the client computer.

--please don't forget to Accept as answer if the reply is helpful--

Brian Cerveny 66 Reputation points

2021-12-15T21:36:24.73+00:00

This GPO does not solve the problem! You will continue to see mDNS traffic.

This person has created an extensive and helpful solution https://f20.be/blog/mdns

It involves setting a registry setting and mDNS parameters.

3 additional answers

Your answer

Anonymous

2020-11-18T11:09:29.627+00:00

Also, can somebody tell me where does eliassal.local come from, it seems that it is a like a host from DNS but I have no machines with such name
Brian Cerveny 66 Reputation points

2021-12-15T21:36:24.73+00:00

This GPO does not solve the problem! You will continue to see mDNS traffic.

This person has created an extensive and helpful solution https://f20.be/blog/mdns

It involves setting a registry setting and mDNS parameters.

Answer 1

Andreas Finstad 81

Have a look here: https://f20.be/blog/mdns

Brian Cerveny 66 Reputation points

2021-12-15T21:37:10.487+00:00

Thanks for this fix and all of the time you spent on documentation!!!

Answer 2

Anonymous

Glad to hear it helps.

Is it something related to a recent update by microsoft?

not that I'm aware of.

Brian Cerveny 66 Reputation points

2021-12-02T17:49:02.967+00:00

I've applied a GPO to disable mDNS. I've double-checked the GPO on the local client. The GPO is correct and applied to Computer settings.

Turn off smart multi-homed name resolution - enabled

Turn off multicast name resolution - enabled

I've also checked the TCP/IP WINS settings disable NetBT so no NetBIOS over TCP/IP. I've disabled this on both network adapters Wired and Wireless. I've removed IPv6 as it's not needed.

When I use Wireshark and ping bob.local I can see MDNS traffic. Why is this protocol still working !!!!

I've used this URL as a reference and have disabled and checked all settings according to this article, even checking the registry!!

http://woshub.com/how-to-disable-netbios-over-tcpip-and-llmnr-using-gpo/

I need to fully disable this protocol per our InfoSec Dept.

Answer 3

Anonymous

Ok, yes enabling this key is preventing now this multicast. But still wondering, why I am having this since last week? Is it something related to a recent update by microsoft?

0 comments