Iptables port 5353 -

[Bob Goodwin]

    I often see a long list of of these packets blocked in the
    Firestarter log.


         --------------------- iptables firewall Begin ------------------------ 

         
         Listed by source hosts:
         Logged 63 packets on interface eth0
           From 192.168.1.6 - 63 packets to igmp(0) udp(161,5353) 
         
            

            ---------------------- iptables firewall End
            -------------------------

    It appears that I [192.168.1.6] am the source of them?  Should I
    have 5353 open?  What is there significance?

    Bob Goodwin

[John Summerfield]

Steven Stern wrote:

>  5353 is used by Windows dynamic DNS. If you're not supporting
> dynamic
>  DNS on your local network, you can continue to drop/ignore the packets.
>  They're needed only by a DNS/DHCP server. 
I don't think so.

Google combinations of "udp port 5353" "zeroconf rfc"
"zeroconf" 
"bonjour" and "rendezvous."


I have it open, but then I see the occasional Mac. I don't think Linux 
(yet) actively uses it; Windows XP does not, unless one downloads some 
software from Apple.

I think Windows addresses the same sorts of problems with uPnP.


-- 

Cheers
John

-- spambait
1aaaaaaa(a)coco.merseine.nu  Z1aaaaaaa(a)coco.merseine.nu
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375

Please do not reply off-list

[Bob Goodwin]

Luciano Rocha wrote:
>  On Sun, Nov 04, 2007 at 10:42:26AM -0500, Bob Goodwin wrote:
>    
> >  Should I open this port?  would it benefit the Windows and Mac users on my 
> >  LAN?
> >     
>
>  Only if you want to share services that use it (iTunes or rhythmbox
>  music share, some other stuff).
>     
I keep iTunes blocked in the router along with a number of others, 
bittorrent, etc., I do unblock iTunes long enough for the kids to 
download some music and then kill it again.
>    
> > If so will it do that without increasing traffic to and from my ISP?
> >     
>
>  mDNS and bonjour/rendevouz work only in your LAN, they don't go to/from the
>  internet. (non-routable local multicast address)
>
>
>     
Apparently, if I understand what you are saying, it would not benefit 
the Windows computer users when surfing, reading news, and such so I 
will leave port 5353 closed then.

Thank you.

Bob Goodwin

[Bob Goodwin]

Steven Stern wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>
>  On 11/04/2007 06:45 AM, Bob Goodwin wrote:
>    
> >    I often see a long list of of these packets blocked in the
> >    Firestarter log.
> >
> >
> >         --------------------- iptables firewall Begin
> > ------------------------
> >                 Listed by source hosts:
> >         Logged 63 packets on interface eth0
> >           From 192.168.1.6 - 63 packets to igmp(0) udp(161,5353)        
> >           
> >            ---------------------- iptables firewall End
> >            -------------------------
> >
> >    It appears that I [192.168.1.6] am the source of them?  Should I
> >    have 5353 open?  What is their significance?
> >
> >    Bob Goodwin
> >
> >           
> >     
>
>  5353 is used by Windows dynamic DNS. If you're not supporting dynamic
>  DNS on your local network, you can continue to drop/ignore the packets.
>  They're needed only by a DNS/DHCP server.
>
>  - --
>
>    Steve 
That raises the question then, why am I trying to send them? 
Do I have something configured wrong?

Bob Goodwin

[Mikkel]

Bob Goodwin wrote:
>  I guess I need to continue looking into this then since anything
> that
>  reduces internet activity in my present situation is a plus.  Wildblue
>  has a "fair use policy," more for their benefit I suspect than for the
>  users, that restricts the amount of traffic through their system [5gB
>  up/17gB down/30 days] and I've been struggling to get this under control
>  recently.
>   
Running a web caching program like Squid would help more, as long as
all the computers are configured to use it.

>  I have two dhcp users, the Mac and an XP, and another XP that has an
>  assigned address on our home LAN.  The two dhcp's always seem to come up
>  with the same addresses.  I configured the router to use
>  192.168.1.21/51  and the Mac usually comes up as 22 the XP as 24.  I can
>  identify them by their mac addresses and that's the way they come up.
>  Curiously in the router dhcp configuration I specified that the Mac
>  should be 192.168.1.21 and it gets assigned 22 while the XP was
>  configured as 23 and it comes up as 24?
>   
If you goofed up the MAC address when configuring the fixed IP
addresses, the addresses will be reserved, but not used. Systems
will tend to get the same IP address from the DHCP server. This is
because of a couple of things. The first is that if they connect
again before the original lease has expired, or if the system
requests the the same IP address and it is not assigned, it will
normally get it. A side affect of this is that if you configure a
fixed IP address after a system has a DHCP lease with a different IP
address, it will keep the one it has. You have to wait for the lease
to expire, or release the current one and ask for a new one.
(dhclient -r eth0)

You may want to add the system names/ip addresses to your hosts file
on the different systems, so you can connect by name, instead of IP
address. For Linux, it is /etc/hosts. The MAC probably uses the same
file. For Windows, it depends on the version...

Here are a few on mine. printserver is an Ethernet print server, and
brother is a Brother MFC-7820N networked all in one machine.

192.168.1.34    mary.infinity-ltd.com mary
192.168.1.100   printserver.infinity-ltd.com printserver
192.168.1.101   brother.infinity-ltd.com brother

As a side note, you can add "DHCPRELEASE=yes" to the
ifcfg-<interface> file to have the DHCP lease released when the
interface is brought down. This can be handy for laptops that
connect to more then one network, especially if the lease time is
longer then the time it takes to go from one network to another.

Mikkel
-- 

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

[Adalbert Prokop]

Bob Goodwin wrote on Sunday 04 November 2007:

>  >>>>    It appears that I [192.168.1.6] am the source of
> them?  Should
>  >>>> I have 5353 open?  What is their significance? 
>  > As Luciano pointed out, it is the mDNS service. Therefor you
> probably
>  > have an active mDNS server instance (e.g. avahi) which announces your
>  > machine throughout the local network. 
>  Should I open this port?  would it benefit the Windows and Mac users
> on
>  my LAN?  If so will it do that without increasing traffic to and from
>  my ISP? 
You benefit depends on your network infrastructure. If you already have a 
DNS server then there is no benefit. If you don't have a DNS then using 
avahi along with nss-mdns give you dynamic IP resolving. For Windows 
Apple's implementation of Zeroconf (namely: Bonjour) is available. For 
Mac, well... batteries included. ;)

For example you can tell avahi to use a domain like .lan (or .local 
or .bunny or ...) for mDNS announces. Then a host name like
"computer.lan" can be resolved to its IP address.

You also get a service discovery feature. With avahi installed an 
application can talk to it on the DBUS and for example annouce "I'm a 
webserver listening on port 8080". Another application on another host 
can ask its own avahi for available services and make use of them. Avahi 
can be configured to announce services for application which cannot (yet) 
talk to it on DBUS, or even for apps running on another host.

Example: If you install Bonjour on a Windows machine, a plugin for 
Internet Explorer will be installed presenting available WWW servers.

Still: if you have a small home network of at most 5 computers there is 
very little advantage. And DNS-SD (DNS Service Discovery) only works on 
the local net, it does not pass network boundaries or dial-up-connections 
(Multicast feature must be available).

>  Googling mdns has not been very helpful in answering my questions ...
http://en.wikipedia.org/wiki/MDNS

-- 
bye,
Adalbert

Duckies are fun!

[John Summerfield]

Mikkel L. Ellertson wrote:
>  Bob Goodwin wrote:
> > I guess I need to continue looking into this then since anything that
> > reduces internet activity in my present situation is a plus.  Wildblue
> > has a "fair use policy," more for their benefit I suspect than for the
> > users, that restricts the amount of traffic through their system [5gB
> > up/17gB down/30 days] and I've been struggling to get this under control
> > recently.
> >
>  Running a web caching program like Squid would help more, as long as
>  all the computers are configured to use it. 
transparent proxy is good for ensuring they do.


>  You may want to add the system names/ip addresses to your hosts file
>  on the different systems, so you can connect by name, instead of IP
>  address. For Linux, it is /etc/hosts. The MAC probably uses the same
>  file. For Windows, it depends on the version...
>  
>  Here are a few on mine. printserver is an Ethernet print server, and
>  brother is a Brother MFC-7820N networked all in one machine.
>  
>  192.168.1.34    mary.infinity-ltd.com mary
>  192.168.1.100   printserver.infinity-ltd.com printserver
>  192.168.1.101   brother.infinity-ltd.com brother 
I prefer to use my own DNS server; it works better, and is more educational.



-- 

Cheers
John

-- spambait
1aaaaaaa(a)coco.merseine.nu  Z1aaaaaaa(a)coco.merseine.nu
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375

Please do not reply off-list

[John Summerfield]

Bob Goodwin wrote:
>  John Summerfield wrote:
> > Steven Stern wrote:
> >
> >> 5353 is used by Windows dynamic DNS. If you're not supporting dynamic
> >> DNS on your local network, you can continue to drop/ignore the packets.
> >> They're needed only by a DNS/DHCP server.
> >
> > I don't think so.
> >
> > Google combinations of "udp port 5353" "zeroconf rfc"
> "zeroconf" 
> > "bonjour" and "rendezvous."
> >
> >
> > I have it open, but then I see the occasional Mac. I don't think Linux 
> > (yet) actively uses it; Windows XP does not, unless one downloads some 
> > software from Apple.
> >
> > I think Windows addresses the same sorts of problems with uPnP.
> >
> >
>  It appears that the stimulus for this is my daughters Apple Mac which 
>  sends 224.0.0.251 and my computer tries to respond on port 5353.  Her 
>  computer runs dhcp connecting directly via an ethernet cable to the 
>  wireless router since it is on her desk.
>  
>  I guess then the question is if I open 5353 will she have access to my 
>  DNS?  Is this an indication that her computer needs that access?  Would 
>  it benefit?
>  
>  It's simple enough to try it but I still wont know if it accomplishes 
>  anything.
>  
>  I would think she must have access to the DNS server provided by 
>  Wildblue but it's been a year and a half since we set that one up and I 
>  don't recall what was done and I am lost whenever I use her Mac ...
>  
>  Bob Goodwin
>   
Apple uses udp port 5353 as part of its aim to have its computers to 
configure themselves. One can, in principal, attach Apple Mac and other 
compliant devices into a switch and they will all find each other. Sally 
can share her photos, Jason his music an printer, and many other 
services, and everyone will find everything. Including compliant printers.

Apple called the feaure "Rendezvous" (let's get together), then 
"Bonjour" (Good day as in "hello"). The generic term is "zero 
configuration" and one can learn more from zeroconf.org.

There are Internet standards for zeroconf, and Apple releases its 
bonjour source code.


Linux participates to the extent that it can broadcast services, but 
more work needs to be done before it "just works" as well as OS X does.

I generally enable it, in hopes that one day it will be useful.


fwiw the mdns protocol governing UDP port 5353 is based on the dns 
protocol governing UDP port 53.


zeroconf is not a substitute for dhcp; lacking a DHCP server, Macs 
default to self-assigned IP addresses, but they will use both if they can.




-- 

Cheers
John

-- spambait
1aaaaaaa(a)coco.merseine.nu  Z1aaaaaaa(a)coco.merseine.nu
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375

Please do not reply off-list

[Mikkel]

John Summerfield wrote:
>  
>  I prefer to use my own DNS server; it works better, and is more
>  educational.
>   
Well, I have run bind in the past. I have done a fair number of zone
files, and had the usual problems of forgetting to increment the
version number once or twice. Currently I am running dnsmasq and
letting it read the /etc/hosts file. For a home network, with few
computers, programs like dnsmasq are probably a better choice. It
can also function as a DHCP server, or read the leases file of a
"real" DHCP server.

Even though it is less educational, running a package that combines
a DHCP server and a DNS server, and lets you use simple config files
are probably a better idea for a home network. It gives you  time to
explore other areas.

On the other hand, I actually enjoyed configuring bind, dhcpd, and
tftp. - I have even set up dhcp and Etherboot to use a second server
as the tftp server. At one of the LUG meetings, I brought along a
pre-configured server so we could boot Linux from the computers in a
computer lab without touching their hard drives. They could not boot
from the CD, but could do a PXE boot. (We could not access the BIOS,
but could do a network boot...)

Mikkel
-- 

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

[Bob Goodwin]

Mikkel L. Ellertson wrote:
>  Bob Goodwin wrote:
>    
> > It appears that the stimulus for this is my daughters Apple Mac which
> > sends 224.0.0.251 and my computer tries to respond on port 5353.  Her
> > computer runs dhcp connecting directly via an ethernet cable to the
> > wireless router since it is on her desk.
> >
> > I guess then the question is if I open 5353 will she have access to my
> > DNS?  Is this an indication that her computer needs that access?  Would
> > it benefit?
> >
> > It's simple enough to try it but I still wont know if it accomplishes
> > anything.
> >
> > I would think she must have access to the DNS server provided by
> > Wildblue but it's been a year and a half since we set that one up and I
> > don't recall what was done and I am lost whenever I use her Mac ...
> >
> > Bob Goodwin
> >
> >     
>  Let me preface this by saying that I do not run zero-config, and I
>  do not have a MAC. So while I know how this is supposed to work, I
>  have not verified it.
>
>  If you open port 5353, what should happen is that your Linux box
>  will know how to reach the MAC by using its host name. The MAC will
>  be able to access the Linux box using its host name. For this to
>  work, both machines have to be running the zero-config daemon. But
>  it looks like they are, or you would not be getting this traffic. If
>  you add a Windows machine with zero-config enabled, it will also
>  show up. This does not set up other machines on the network to use
>  the DNS server on your Linux machine. They will still use the DNS
>  server supplied by the DHCP server. (Probably the wireless router.)
>
>  For a small home network, I prefer to configure the DHCP server to
>  give each machine a fixed address, and then add them to the hosts
>  file for each machine. For a larger network, I like to have a Linux
>  machine that is the DHCP and DNS server for the network. As part of
>  that, it updates its DNS table to match assigned IP addresses. It
>  also have the advantage of caching DNS entries locally, cutting down
>  slightly on Internet traffic, and speeding up DNS lookups for
>  machines on the local network.
>
>  Mikkel
>     
I guess I need to continue looking into this then since anything that 
reduces internet activity in my present situation is a plus.  Wildblue 
has a "fair use policy," more for their benefit I suspect than for the 
users, that restricts the amount of traffic through their system [5gB 
up/17gB down/30 days] and I've been struggling to get this under control 
recently.

I have two dhcp users, the Mac and an XP, and another XP that has an 
assigned address on our home LAN.  The two dhcp's always seem to come up 
with the same addresses.  I configured the router to use 
192.168.1.21/51  and the Mac usually comes up as 22 the XP as 24.  I can 
identify them by their mac addresses and that's the way they come up. 
Curiously in the router dhcp configuration I specified that the Mac 
should be 192.168.1.21 and it gets assigned 22 while the XP was 
configured as 23 and it comes up as 24?

I need to learn more about this.  There's enough here to keep me 
confused for a while!

Thanks for the help. 

Bob Goodwin

[Mikkel]

Bob Goodwin wrote:
>  It appears that the stimulus for this is my daughters Apple Mac
> which
>  sends 224.0.0.251 and my computer tries to respond on port 5353.  Her
>  computer runs dhcp connecting directly via an ethernet cable to the
>  wireless router since it is on her desk.
>  
>  I guess then the question is if I open 5353 will she have access to my
>  DNS?  Is this an indication that her computer needs that access?  Would
>  it benefit?
>  
>  It's simple enough to try it but I still wont know if it accomplishes
>  anything.
>  
>  I would think she must have access to the DNS server provided by
>  Wildblue but it's been a year and a half since we set that one up and I
>  don't recall what was done and I am lost whenever I use her Mac ...
>  
>  Bob Goodwin
>   
Let me preface this by saying that I do not run zero-config, and I
do not have a MAC. So while I know how this is supposed to work, I
have not verified it.

If you open port 5353, what should happen is that your Linux box
will know how to reach the MAC by using its host name. The MAC will
be able to access the Linux box using its host name. For this to
work, both machines have to be running the zero-config daemon. But
it looks like they are, or you would not be getting this traffic. If
you add a Windows machine with zero-config enabled, it will also
show up. This does not set up other machines on the network to use
the DNS server on your Linux machine. They will still use the DNS
server supplied by the DHCP server. (Probably the wireless router.)

For a small home network, I prefer to configure the DHCP server to
give each machine a fixed address, and then add them to the hosts
file for each machine. For a larger network, I like to have a Linux
machine that is the DHCP and DNS server for the network. As part of
that, it updates its DNS table to match assigned IP addresses. It
also have the advantage of caching DNS entries locally, cutting down
slightly on Internet traffic, and speeding up DNS lookups for
machines on the local network.

Mikkel
-- 

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

[Luciano Miguel Ferreira Rocha]

On Sun, Nov 04, 2007 at 10:42:26AM -0500, Bob Goodwin wrote:
>   Should I open this port?  would it benefit the Windows and Mac users
> on my 
>   LAN? 
Only if you want to share services that use it (iTunes or rhythmbox
music share, some other stuff).

>  If so will it do that without increasing traffic to and from my ISP?
mDNS and bonjour/rendevouz work only in your LAN, they don't go to/from the
internet. (non-routable local multicast address)


-- 
lfr
0/0

[Bob Goodwin]

John Summerfield wrote:
>  Steven Stern wrote:
>
> > 5353 is used by Windows dynamic DNS. If you're not supporting dynamic
> > DNS on your local network, you can continue to drop/ignore the packets.
> > They're needed only by a DNS/DHCP server.
>
>  I don't think so.
>
>  Google combinations of "udp port 5353" "zeroconf rfc"
> "zeroconf" 
>  "bonjour" and "rendezvous."
>
>
>  I have it open, but then I see the occasional Mac. I don't think Linux 
>  (yet) actively uses it; Windows XP does not, unless one downloads some 
>  software from Apple.
>
>  I think Windows addresses the same sorts of problems with uPnP.
>
>  
It appears that the stimulus for this is my daughters Apple Mac which 
sends 224.0.0.251 and my computer tries to respond on port 5353.  Her 
computer runs dhcp connecting directly via an ethernet cable to the 
wireless router since it is on her desk.

I guess then the question is if I open 5353 will she have access to my 
DNS?  Is this an indication that her computer needs that access?  Would 
it benefit?

It's simple enough to try it but I still wont know if it accomplishes 
anything.

I would think she must have access to the DNS server provided by 
Wildblue but it's been a year and a half since we set that one up and I 
don't recall what was done and I am lost whenever I use her Mac ...

Bob Goodwin

[Bob Goodwin]

Adalbert Prokop wrote:
>  Bob Goodwin wrote on Sunday 04 November 2007:
>
>    
> >>>                 Listed by source hosts:
> >>>         Logged 63 packets on interface eth0
> >>>           From 192.168.1.6 - 63 packets to igmp(0) udp(161,5353)
> >>>         
>
>    
> >>>    It appears that I [192.168.1.6] am the source of them?  Should I
> >>>    have 5353 open?  What is their significance?
> >>>         
>
>    
> >> 5353 is used by Windows dynamic DNS. If you're not supporting dynamic
> >> DNS on your local network, you can continue to drop/ignore the
> >> packets. They're needed only by a DNS/DHCP server.
> >>       
>
>    
> > That raises the question then, why am I trying to send them?
> > Do I have something configured wrong?
> >     
>
>  As Luciano pointed out, it is the mDNS service. Therefor you probably have 
>  an active mDNS server instance (e.g. avahi) which announces your machine 
>  throughout the local network.
>
>     
Should I open this port?  would it benefit the Windows and Mac users on 
my LAN?  If so will it do that without increasing traffic to and from my 
ISP?

Googling mdns has not been very helpful in answering my questions ...

Bob Goodwin

[Adalbert Prokop]

Bob Goodwin wrote on Sunday 04 November 2007:

>  >>                 Listed by source hosts:
>  >>         Logged 63 packets on interface eth0
>  >>           From 192.168.1.6 - 63 packets to igmp(0) udp(161,5353) 
>  >>    It appears that I [192.168.1.6] am the source of them? 
> Should I
>  >>    have 5353 open?  What is their significance? 
>  > 5353 is used by Windows dynamic DNS. If you're not
> supporting dynamic
>  > DNS on your local network, you can continue to drop/ignore the
>  > packets. They're needed only by a DNS/DHCP server. 
>  That raises the question then, why am I trying to send them?
>  Do I have something configured wrong? 
As Luciano pointed out, it is the mDNS service. Therefor you probably have 
an active mDNS server instance (e.g. avahi) which announces your machine 
throughout the local network.

-- 
bye,
Adalbert

The absurd is the essential concept and the first truth. -- A. Camus

[Luciano Miguel Ferreira Rocha]

On Sun, Nov 04, 2007 at 08:07:20AM -0600, Steven Stern wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>  
>  On 11/04/2007 06:45 AM, Bob Goodwin wrote:
>  > 
>  >    I often see a long list of of these packets blocked in the
>  >    Firestarter log.
>  > 
>  > 
>  >         --------------------- iptables firewall Begin
>  > ------------------------
>  >                 Listed by source hosts:
>  >         Logged 63 packets on interface eth0
>  >           From 192.168.1.6 - 63 packets to igmp(0) udp(161,5353)        
>  >           
>  >            ---------------------- iptables firewall End
>  >            -------------------------
>  > 
>  >    It appears that I [192.168.1.6] am the source of them?  Should I
>  >    have 5353 open?  What is there significance?
>  > 
>  >    Bob Goodwin
>  > 
>  >           
>  
>  5353 is used by Windows dynamic DNS. If you're not supporting dynamic
>  DNS on your local network, you can continue to drop/ignore the packets.
>  They're needed only by a DNS/DHCP server. 
5353 is multicast DNS (mDNS), part of bonjour/rendevouz, used by Apple,
Linux and others, for service discovery.

-- 
lfr
0/0

[SternData]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/04/2007 06:45 AM, Bob Goodwin wrote:
>  
>     I often see a long list of of these packets blocked in the
>     Firestarter log.
>  
>  
>          --------------------- iptables firewall Begin
>  ------------------------
>                  Listed by source hosts:
>          Logged 63 packets on interface eth0
>            From 192.168.1.6 - 63 packets to igmp(0) udp(161,5353)        
>            
>             ---------------------- iptables firewall End
>             -------------------------
>  
>     It appears that I [192.168.1.6] am the source of them?  Should I
>     have 5353 open?  What is there significance?
>  
>     Bob Goodwin
>  
>             
5353 is used by Windows dynamic DNS. If you're not supporting dynamic
DNS on your local network, you can continue to drop/ignore the packets.
They're needed only by a DNS/DHCP server.

- --

  Steve
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iD8DBQFHLdIYeERILVgMyvARAhmQAJ45aA6r5eadLPB1NiqfNrlZ6WMJAgCffpIR
> M16yJYAqrtq3m5ZPFHqYzMU=
> =uI8g
> -----END PGP SIGNATURE-----