{
	"id": "f82e321c-0942-491f-af22-ea280e49e02f",
	"created_at": "2026-04-06T00:22:09.402817Z",
	"updated_at": "2026-04-10T03:21:19.838307Z",
	"deleted_at": null,
	"sha1_hash": "d8697e872a9bb155789a9fa80668afdaff2ab5ad",
	"title": "Link-Local Multicast Name Resolution",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 61581,
	"plain_text": "Link-Local Multicast Name Resolution\r\nBy Contributors to Wikimedia projects\r\nPublished: 2007-09-14 · Archived: 2026-04-05 20:16:44 UTC\r\nFrom Wikipedia, the free encyclopedia\r\nThe Link-Local Multicast Name Resolution (LLMNR) is a protocol based on the Domain Name System (DNS)\r\npacket format that allows both IPv4 and IPv6 hosts to perform name resolution for hosts on the same local link. It\r\nis included in Windows Vista, Windows Server 2008, Windows 7, Windows 8, Windows 10.\r\n[1]\r\n It is also\r\nimplemented by systemd-resolved on Linux.[2] LLMNR is defined in RFC 4795 but was not adopted as an IETF\r\nstandard.[3]\r\nAs of April 2022, Microsoft has begun the process of phasing out both LLMNR and NetBIOS name resolution in\r\nfavour of mDNS.\r\n[4]\r\nIn responding to queries, responders listen on UDP port 5355 on the following link-scope Multicast address:\r\nIPv4 - 224.0.0.252, MAC address 01-00-5E-00-00-FC\r\nIPv6 - FF02:0:0:0:0:0:1:3 (this notation can be abbreviated as FF02::1:3), MAC address 33-33-00-01-00-\r\n03\r\nThe responders also listen on TCP port 5355 on the unicast address that the host uses to respond to queries.\r\nBit offset 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15\r\n0 ID\r\n16 QR Opcode C TC T Z Z Z Z RCODE\r\n32 QDCOUNT\r\n48 ANCOUNT\r\n64 NSCOUNT\r\n80 ARCOUNT\r\nID - A 16-bit identifier assigned by the program that generates any kind of query.\r\nQR - Query/Response.\r\nOPCODE - A 4-bit field that specifies the kind of query in this message. This value is set by the originator\r\nof a query and copied into the response. This specification defines the behavior of standard queries and\r\nresponses (opcode value of zero). Future specifications may define the use of other opcodes with LLMNR.\r\nC - Conflict.\r\nhttps://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution\r\nPage 1 of 2\n\nTC - TrunCation.\r\nT - Tentative.\r\nZ - Reserved for future use.\r\nRCODE - Response code.\r\nQDCOUNT - An unsigned 16-bit integer specifying the number of entries in the question section.\r\nANCOUNT - An unsigned 16-bit integer specifying the number of resource records in the answer section.\r\nNSCOUNT - An unsigned 16-bit integer specifying the number of name server resource records in the\r\nauthority records section.\r\nARCOUNT - An unsigned 16-bit integer specifying the number of resource records in the additional\r\nrecords section.\r\nNetwork Basic Input/Output System (NetBIOS)\r\nPeer Name Resolution Protocol (PNRP)\r\nMulticast DNS (mDNS)\r\nZero-configuration networking (Zeroconf)\r\n1. ^ LLMNR: The Cable Guy\r\n2. ^ \"systemd 216 available\". Retrieved 2015-08-10.\r\n3. ^ Mikael Eiman (2015-05-25). \"LLMNR, Multicast DNS and names on your LAN\". Retrieved 2021-01-30.\r\n4. ^ Aligning on mDNS: ramping down NetBIOS name resolution and LLMNR\r\nLink-Local Multicast Name Resolution, Microsoft TechNet\r\nRFC 4795, Informational, Link-Local Multicast Name Resolution (LLMNR)\r\nLLMNR, Multicast DNS and names on your LAN\r\nSource: https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution\r\nhttps://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution"
	],
	"report_names": [
		"Link-Local_Multicast_Name_Resolution"
	],
	"threat_actors": [],
	"ts_created_at": 1775434929,
	"ts_updated_at": 1775791279,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/d8697e872a9bb155789a9fa80668afdaff2ab5ad.pdf",
		"text": "https://archive.orkl.eu/d8697e872a9bb155789a9fa80668afdaff2ab5ad.txt",
		"img": "https://archive.orkl.eu/d8697e872a9bb155789a9fa80668afdaff2ab5ad.jpg"
	}
}