[ATP/FLEX]How to check multicast DNS packet in the firewall?

Zyxel_Jeff
Zyxel_Jeff Posts: 1,317  Zyxel Employee
100 Answers 500 Comments Friend Collector Fourth Anniversary

Scenario :

The user may encounter a problem where there is traffic related to port 5353 (multicast DNS) being dropped by the security policy, but they may not know which client IP is generating the traffic, as shown below:

how to check mDNS packet.png

This FAQ will guide you on how to check it.

Answer :

The user can utilize the CLI command "show sdwan interface" to list all interfaces and use the CLI "packet-trace interface interface name port 5353" to capture traffic related to port 5353 on the specified interface.

interface settings.png

For example, using the command "packet-trace interface vlan10 port 5353" enables us to identify IPs attempting to send multicast DNS packets on port 5353 within the network environment.

5353 port Multicast DNS packet.png