I often see a long list of of these packets blocked in the Firestarter log.
--------------------- iptables firewall Begin ------------------------
Listed by source hosts: Logged 63 packets on interface eth0 From 192.168.1.6 - 63 packets to igmp(0) udp(161,5353)
---------------------- iptables firewall End -------------------------
It appears that I [192.168.1.6] am the source of them? Should I have 5353 open? What is there significance?
Bob Goodwin
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 11/04/2007 06:45 AM, Bob Goodwin wrote:
I often see a long list of of these packets blocked in the Firestarter log.
--------------------- iptables firewall Begin
Listed by source hosts: Logged 63 packets on interface eth0 From 192.168.1.6 - 63 packets to igmp(0) udp(161,5353) ---------------------- iptables firewall End -------------------------
It appears that I [192.168.1.6] am the source of them? Should I have 5353 open? What is there significance?
Bob Goodwin
5353 is used by Windows dynamic DNS. If you're not supporting dynamic DNS on your local network, you can continue to drop/ignore the packets. They're needed only by a DNS/DHCP server.
- --
Steve
On Sun, Nov 04, 2007 at 08:07:20AM -0600, Steven Stern wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 11/04/2007 06:45 AM, Bob Goodwin wrote:
I often see a long list of of these packets blocked in the Firestarter log.
--------------------- iptables firewall Begin
Listed by source hosts: Logged 63 packets on interface eth0 From 192.168.1.6 - 63 packets to igmp(0) udp(161,5353) ---------------------- iptables firewall End -------------------------
It appears that I [192.168.1.6] am the source of them? Should I have 5353 open? What is there significance?
Bob Goodwin
5353 is used by Windows dynamic DNS. If you're not supporting dynamic DNS on your local network, you can continue to drop/ignore the packets. They're needed only by a DNS/DHCP server.
5353 is multicast DNS (mDNS), part of bonjour/rendevouz, used by Apple, Linux and others, for service discovery.
Steven Stern wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 11/04/2007 06:45 AM, Bob Goodwin wrote:
I often see a long list of of these packets blocked in the Firestarter log.
--------------------- iptables firewall Begin
Listed by source hosts: Logged 63 packets on interface eth0 From 192.168.1.6 - 63 packets to igmp(0) udp(161,5353) ---------------------- iptables firewall End -------------------------
It appears that I [192.168.1.6] am the source of them? Should I have 5353 open? What is their significance?
Bob Goodwin
5353 is used by Windows dynamic DNS. If you're not supporting dynamic DNS on your local network, you can continue to drop/ignore the packets. They're needed only by a DNS/DHCP server.
Steve
That raises the question then, why am I trying to send them? Do I have something configured wrong?
Bob Goodwin
Bob Goodwin wrote on Sunday 04 November 2007:
Listed by source hosts: Logged 63 packets on interface eth0 From 192.168.1.6 - 63 packets to igmp(0) udp(161,5353)
It appears that I [192.168.1.6] am the source of them? Should I have 5353 open? What is their significance?
5353 is used by Windows dynamic DNS. If you're not supporting dynamic DNS on your local network, you can continue to drop/ignore the packets. They're needed only by a DNS/DHCP server.
That raises the question then, why am I trying to send them? Do I have something configured wrong?
As Luciano pointed out, it is the mDNS service. Therefor you probably have an active mDNS server instance (e.g. avahi) which announces your machine throughout the local network.
Adalbert Prokop wrote:
Bob Goodwin wrote on Sunday 04 November 2007:
Listed by source hosts: Logged 63 packets on interface eth0 From 192.168.1.6 - 63 packets to igmp(0) udp(161,5353)
It appears that I [192.168.1.6] am the source of them? Should I have 5353 open? What is their significance?
5353 is used by Windows dynamic DNS. If you're not supporting dynamic DNS on your local network, you can continue to drop/ignore the packets. They're needed only by a DNS/DHCP server.
That raises the question then, why am I trying to send them? Do I have something configured wrong?
As Luciano pointed out, it is the mDNS service. Therefor you probably have an active mDNS server instance (e.g. avahi) which announces your machine throughout the local network.
Should I open this port? would it benefit the Windows and Mac users on my LAN? If so will it do that without increasing traffic to and from my ISP?
Googling mdns has not been very helpful in answering my questions ...
Bob Goodwin
On Sun, Nov 04, 2007 at 10:42:26AM -0500, Bob Goodwin wrote:
Should I open this port? would it benefit the Windows and Mac users on my LAN?
Only if you want to share services that use it (iTunes or rhythmbox music share, some other stuff).
If so will it do that without increasing traffic to and from my ISP?
mDNS and bonjour/rendevouz work only in your LAN, they don't go to/from the internet. (non-routable local multicast address)
Luciano Rocha wrote:
On Sun, Nov 04, 2007 at 10:42:26AM -0500, Bob Goodwin wrote:
Should I open this port? would it benefit the Windows and Mac users on my LAN?
Only if you want to share services that use it (iTunes or rhythmbox music share, some other stuff).
I keep iTunes blocked in the router along with a number of others, bittorrent, etc., I do unblock iTunes long enough for the kids to download some music and then kill it again.
If so will it do that without increasing traffic to and from my ISP?
mDNS and bonjour/rendevouz work only in your LAN, they don't go to/from the internet. (non-routable local multicast address)
Apparently, if I understand what you are saying, it would not benefit the Windows computer users when surfing, reading news, and such so I will leave port 5353 closed then.
Thank you.
Bob Goodwin
Bob Goodwin wrote on Sunday 04 November 2007:
It appears that I [192.168.1.6] am the source of them? Should I have 5353 open? What is their significance?
As Luciano pointed out, it is the mDNS service. Therefor you probably have an active mDNS server instance (e.g. avahi) which announces your machine throughout the local network.
Should I open this port? would it benefit the Windows and Mac users on my LAN? If so will it do that without increasing traffic to and from my ISP?
You benefit depends on your network infrastructure. If you already have a DNS server then there is no benefit. If you don't have a DNS then using avahi along with nss-mdns give you dynamic IP resolving. For Windows Apple's implementation of Zeroconf (namely: Bonjour) is available. For Mac, well... batteries included. ;)
For example you can tell avahi to use a domain like .lan (or .local or .bunny or ...) for mDNS announces. Then a host name like "computer.lan" can be resolved to its IP address.
You also get a service discovery feature. With avahi installed an application can talk to it on the DBUS and for example annouce "I'm a webserver listening on port 8080". Another application on another host can ask its own avahi for available services and make use of them. Avahi can be configured to announce services for application which cannot (yet) talk to it on DBUS, or even for apps running on another host.
Example: If you install Bonjour on a Windows machine, a plugin for Internet Explorer will be installed presenting available WWW servers.
Still: if you have a small home network of at most 5 computers there is very little advantage. And DNS-SD (DNS Service Discovery) only works on the local net, it does not pass network boundaries or dial-up-connections (Multicast feature must be available).
Googling mdns has not been very helpful in answering my questions ...
http://en.wikipedia.org/wiki/MDNS
Steven Stern wrote:
5353 is used by Windows dynamic DNS. If you're not supporting dynamic DNS on your local network, you can continue to drop/ignore the packets. They're needed only by a DNS/DHCP server.
I don't think so.
Google combinations of "udp port 5353" "zeroconf rfc" "zeroconf" "bonjour" and "rendezvous."
I have it open, but then I see the occasional Mac. I don't think Linux (yet) actively uses it; Windows XP does not, unless one downloads some software from Apple.
I think Windows addresses the same sorts of problems with uPnP.
John Summerfield wrote:
Steven Stern wrote:
5353 is used by Windows dynamic DNS. If you're not supporting dynamic DNS on your local network, you can continue to drop/ignore the packets. They're needed only by a DNS/DHCP server.
I don't think so.
Google combinations of "udp port 5353" "zeroconf rfc" "zeroconf" "bonjour" and "rendezvous."
I have it open, but then I see the occasional Mac. I don't think Linux (yet) actively uses it; Windows XP does not, unless one downloads some software from Apple.
I think Windows addresses the same sorts of problems with uPnP.
It appears that the stimulus for this is my daughters Apple Mac which sends 224.0.0.251 and my computer tries to respond on port 5353. Her computer runs dhcp connecting directly via an ethernet cable to the wireless router since it is on her desk.
I guess then the question is if I open 5353 will she have access to my DNS? Is this an indication that her computer needs that access? Would it benefit?
It's simple enough to try it but I still wont know if it accomplishes anything.
I would think she must have access to the DNS server provided by Wildblue but it's been a year and a half since we set that one up and I don't recall what was done and I am lost whenever I use her Mac ...
Bob Goodwin
Bob Goodwin wrote:
It appears that the stimulus for this is my daughters Apple Mac which sends 224.0.0.251 and my computer tries to respond on port 5353. Her computer runs dhcp connecting directly via an ethernet cable to the wireless router since it is on her desk.
I guess then the question is if I open 5353 will she have access to my DNS? Is this an indication that her computer needs that access? Would it benefit?
It's simple enough to try it but I still wont know if it accomplishes anything.
I would think she must have access to the DNS server provided by Wildblue but it's been a year and a half since we set that one up and I don't recall what was done and I am lost whenever I use her Mac ...
Bob Goodwin
Let me preface this by saying that I do not run zero-config, and I do not have a MAC. So while I know how this is supposed to work, I have not verified it.
If you open port 5353, what should happen is that your Linux box will know how to reach the MAC by using its host name. The MAC will be able to access the Linux box using its host name. For this to work, both machines have to be running the zero-config daemon. But it looks like they are, or you would not be getting this traffic. If you add a Windows machine with zero-config enabled, it will also show up. This does not set up other machines on the network to use the DNS server on your Linux machine. They will still use the DNS server supplied by the DHCP server. (Probably the wireless router.)
For a small home network, I prefer to configure the DHCP server to give each machine a fixed address, and then add them to the hosts file for each machine. For a larger network, I like to have a Linux machine that is the DHCP and DNS server for the network. As part of that, it updates its DNS table to match assigned IP addresses. It also have the advantage of caching DNS entries locally, cutting down slightly on Internet traffic, and speeding up DNS lookups for machines on the local network.
Mikkel
Mikkel L. Ellertson wrote:
Bob Goodwin wrote:
It appears that the stimulus for this is my daughters Apple Mac which sends 224.0.0.251 and my computer tries to respond on port 5353. Her computer runs dhcp connecting directly via an ethernet cable to the wireless router since it is on her desk.
I guess then the question is if I open 5353 will she have access to my DNS? Is this an indication that her computer needs that access? Would it benefit?
It's simple enough to try it but I still wont know if it accomplishes anything.
I would think she must have access to the DNS server provided by Wildblue but it's been a year and a half since we set that one up and I don't recall what was done and I am lost whenever I use her Mac ...
Bob Goodwin
Let me preface this by saying that I do not run zero-config, and I do not have a MAC. So while I know how this is supposed to work, I have not verified it.
If you open port 5353, what should happen is that your Linux box will know how to reach the MAC by using its host name. The MAC will be able to access the Linux box using its host name. For this to work, both machines have to be running the zero-config daemon. But it looks like they are, or you would not be getting this traffic. If you add a Windows machine with zero-config enabled, it will also show up. This does not set up other machines on the network to use the DNS server on your Linux machine. They will still use the DNS server supplied by the DHCP server. (Probably the wireless router.)
For a small home network, I prefer to configure the DHCP server to give each machine a fixed address, and then add them to the hosts file for each machine. For a larger network, I like to have a Linux machine that is the DHCP and DNS server for the network. As part of that, it updates its DNS table to match assigned IP addresses. It also have the advantage of caching DNS entries locally, cutting down slightly on Internet traffic, and speeding up DNS lookups for machines on the local network.
Mikkel
I guess I need to continue looking into this then since anything that reduces internet activity in my present situation is a plus. Wildblue has a "fair use policy," more for their benefit I suspect than for the users, that restricts the amount of traffic through their system [5gB up/17gB down/30 days] and I've been struggling to get this under control recently.
I have two dhcp users, the Mac and an XP, and another XP that has an assigned address on our home LAN. The two dhcp's always seem to come up with the same addresses. I configured the router to use 192.168.1.21/51 and the Mac usually comes up as 22 the XP as 24. I can identify them by their mac addresses and that's the way they come up. Curiously in the router dhcp configuration I specified that the Mac should be 192.168.1.21 and it gets assigned 22 while the XP was configured as 23 and it comes up as 24?
I need to learn more about this. There's enough here to keep me confused for a while!
Thanks for the help.
Bob Goodwin
Bob Goodwin wrote:
I guess I need to continue looking into this then since anything that reduces internet activity in my present situation is a plus. Wildblue has a "fair use policy," more for their benefit I suspect than for the users, that restricts the amount of traffic through their system [5gB up/17gB down/30 days] and I've been struggling to get this under control recently.
Running a web caching program like Squid would help more, as long as all the computers are configured to use it.
I have two dhcp users, the Mac and an XP, and another XP that has an assigned address on our home LAN. The two dhcp's always seem to come up with the same addresses. I configured the router to use 192.168.1.21/51 and the Mac usually comes up as 22 the XP as 24. I can identify them by their mac addresses and that's the way they come up. Curiously in the router dhcp configuration I specified that the Mac should be 192.168.1.21 and it gets assigned 22 while the XP was configured as 23 and it comes up as 24?
If you goofed up the MAC address when configuring the fixed IP addresses, the addresses will be reserved, but not used. Systems will tend to get the same IP address from the DHCP server. This is because of a couple of things. The first is that if they connect again before the original lease has expired, or if the system requests the the same IP address and it is not assigned, it will normally get it. A side affect of this is that if you configure a fixed IP address after a system has a DHCP lease with a different IP address, it will keep the one it has. You have to wait for the lease to expire, or release the current one and ask for a new one. (dhclient -r eth0)
You may want to add the system names/ip addresses to your hosts file on the different systems, so you can connect by name, instead of IP address. For Linux, it is /etc/hosts. The MAC probably uses the same file. For Windows, it depends on the version...
Here are a few on mine. printserver is an Ethernet print server, and brother is a Brother MFC-7820N networked all in one machine.
192.168.1.34 mary.infinity-ltd.com mary 192.168.1.100 printserver.infinity-ltd.com printserver 192.168.1.101 brother.infinity-ltd.com brother
As a side note, you can add "DHCPRELEASE=yes" to the ifcfg-<interface> file to have the DHCP lease released when the interface is brought down. This can be handy for laptops that connect to more then one network, especially if the lease time is longer then the time it takes to go from one network to another.
Mikkel
Bob Goodwin wrote:
John Summerfield wrote:
Steven Stern wrote:
5353 is used by Windows dynamic DNS. If you're not supporting dynamic DNS on your local network, you can continue to drop/ignore the packets. They're needed only by a DNS/DHCP server.
I don't think so.
Google combinations of "udp port 5353" "zeroconf rfc" "zeroconf" "bonjour" and "rendezvous."
I have it open, but then I see the occasional Mac. I don't think Linux (yet) actively uses it; Windows XP does not, unless one downloads some software from Apple.
I think Windows addresses the same sorts of problems with uPnP.
It appears that the stimulus for this is my daughters Apple Mac which sends 224.0.0.251 and my computer tries to respond on port 5353. Her computer runs dhcp connecting directly via an ethernet cable to the wireless router since it is on her desk.
I guess then the question is if I open 5353 will she have access to my DNS? Is this an indication that her computer needs that access? Would it benefit?
It's simple enough to try it but I still wont know if it accomplishes anything.
I would think she must have access to the DNS server provided by Wildblue but it's been a year and a half since we set that one up and I don't recall what was done and I am lost whenever I use her Mac ...
Bob Goodwin
Apple uses udp port 5353 as part of its aim to have its computers to configure themselves. One can, in principal, attach Apple Mac and other compliant devices into a switch and they will all find each other. Sally can share her photos, Jason his music an printer, and many other services, and everyone will find everything. Including compliant printers.
Apple called the feaure "Rendezvous" (let's get together), then "Bonjour" (Good day as in "hello"). The generic term is "zero configuration" and one can learn more from zeroconf.org.
There are Internet standards for zeroconf, and Apple releases its bonjour source code.
Linux participates to the extent that it can broadcast services, but more work needs to be done before it "just works" as well as OS X does.
I generally enable it, in hopes that one day it will be useful.
fwiw the mdns protocol governing UDP port 5353 is based on the dns protocol governing UDP port 53.
zeroconf is not a substitute for dhcp; lacking a DHCP server, Macs default to self-assigned IP addresses, but they will use both if they can.
Mikkel L. Ellertson wrote:
Bob Goodwin wrote:
I guess I need to continue looking into this then since anything that reduces internet activity in my present situation is a plus. Wildblue has a "fair use policy," more for their benefit I suspect than for the users, that restricts the amount of traffic through their system [5gB up/17gB down/30 days] and I've been struggling to get this under control recently.
Running a web caching program like Squid would help more, as long as all the computers are configured to use it.
transparent proxy is good for ensuring they do.
You may want to add the system names/ip addresses to your hosts file on the different systems, so you can connect by name, instead of IP address. For Linux, it is /etc/hosts. The MAC probably uses the same file. For Windows, it depends on the version...
Here are a few on mine. printserver is an Ethernet print server, and brother is a Brother MFC-7820N networked all in one machine.
192.168.1.34 mary.infinity-ltd.com mary 192.168.1.100 printserver.infinity-ltd.com printserver 192.168.1.101 brother.infinity-ltd.com brother
I prefer to use my own DNS server; it works better, and is more educational.
John Summerfield wrote:
I prefer to use my own DNS server; it works better, and is more educational.
Well, I have run bind in the past. I have done a fair number of zone files, and had the usual problems of forgetting to increment the version number once or twice. Currently I am running dnsmasq and letting it read the /etc/hosts file. For a home network, with few computers, programs like dnsmasq are probably a better choice. It can also function as a DHCP server, or read the leases file of a "real" DHCP server.
Even though it is less educational, running a package that combines a DHCP server and a DNS server, and lets you use simple config files are probably a better idea for a home network. It gives you time to explore other areas.
On the other hand, I actually enjoyed configuring bind, dhcpd, and tftp. - I have even set up dhcp and Etherboot to use a second server as the tftp server. At one of the LUG meetings, I brought along a pre-configured server so we could boot Linux from the computers in a computer lab without touching their hard drives. They could not boot from the CD, but could do a PXE boot. (We could not access the BIOS, but could do a network boot...)
Mikkel