I noticed that a android in my network is constantly connect to Multicast DNS IP. I seen this because my firewall block this inbound connection. Other devices connects to that IP too, but this android in specific seems to do this all the time, and this user (my father) is not concerned about security.

I would like to know if this type of connection can spread some infection (if exists), since my PC has firewall, but other androids has not (not rooted).


Multicast DNS is a protocol which is used by devices on the network announce to the rest of the local network that they are there (name) and what services they offer to others (printing, audio...). It is not really a connection but a broadcast, i.e. the information are send to a special multicast address and all devices on the local network will listen for information on this address.

Sure, it makes it easier to discover for an intruder in the local network what else is there, since it was explicitly designed for providing this kind of information (i.e. use devices and services without much explicit configuration). It can also be used by an intruder to announce itself as some service in the hope that others will connect to it. But it can not really be used to spread malware by itself - unless the recipients mDNS stack is broken.

Thus while there were (of course) bugs in the related network stacks in the past and might also be there currently, it is no more dangerous than any other network protocols you use, probably even less since it should be restricted to the local network. In other words: there are probably more serious problems in your network you should worry about.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.