The Full Wiki

More info on Link-local Multicast Name Resolution

Link-local Multicast Name Resolution: Wikis


Note: Many of our articles have direct quotes from sources you can cite, within the Wikipedia article! This article doesn't yet, but we're working on it! See more info or our list of citable articles.


From Wikipedia, the free encyclopedia

The Internet Protocol Suite
Application Layer
BGP · DHCP · DNS · FTP · GTP · HTTP · IMAP · IRC · Megaco · MGCP · NNTP · NTP · POP · RIP · RPC · RTP · RTSP · SDP · SIP · SMTP · SNMP · SOAP · SSH · Telnet · TLS/SSL · XMPP · (more)
Transport Layer
TCP · UDP · DCCP · SCTP · RSVP · ECN · (more)
Internet Layer
IP (IPv4, IPv6) · ICMP · ICMPv6 · IGMP · IPsec · (more)
Link Layer
ARP/InARP · NDP · OSPF · Tunnels (L2TP) · PPP · Media Access Control (Ethernet, DSL, ISDN, FDDI) · (more)

The Link Local Multicast Name Resolution (or LLMNR) is a protocol based on the Domain Name System (DNS) packet format that allows both IPv4 and IPv6 hosts to perform name resolution for hosts on the same local link. It is included in Windows Vista, Windows Server 2008 and Windows 7.[1]


Protocol details

In responding to queries, responders listen on UDP port 5355 on the following link-scope Multicast address:

  • IPv4 -, MAC of 01-00-5E-00-00-FC
  • IPv6 - FF02:0:0:0:0:0:1:3 (this notation can be abbreviated as FF02::1:3)

The responders also listen on TCP port 5355 on the unicast address that the host uses to respond to queries.

Packet header structure

Bit offset 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
0 ID
16 QR Opcode C TC T Z Z Z Z RCODE
  • ID - A 16-bit identifier assigned by the program that generates any kind of query.
  • QR - Query/Response.
  • OPCODE - A 4-bit field that specifies the kind of query in this message. This value is set by the originator of a query and copied into the response. This specification defines the behavior of standard queries and responses (opcode value of zero). Future specifications may define the use of other opcodes with LLMNR.
  • C - Conflict.
  • TC - TrunCation.
  • T - Tentative.
  • Z - Reserved for future use.
  • RCODE - Response code.
  • QDCOUNT - An unsigned 16-bit integer specifying the number of entries in the question section.
  • ANCOUNT - An unsigned 16-bit integer specifying the number of resource records in the answer section.
  • NSCOUNT - An unsigned 16-bit integer specifying the number of name server resource records in the authority records section.
  • ARCOUNT - An unsigned 16-bit integer specifying the number of resource records in the additional records section.


  1. ^ LLMNR: The Cable Guy

External links



  • RFC 4795, Informational, Link-Local Multicast Name Resolution (LLMNR)

See also


Got something to say? Make a comment.
Your name
Your email address