The Link Local Multicast Name Resolution (LLMNR) is a protocol based on the Domain Name System

Domain name system

The Domain Name System is a hierarchical distributed naming system for computers, services, or any resource connected to the Internet or a private network. It associates various information with domain names assigned to each of the participating entities...

 (DNS) packet format that allows both IPv4

IPv4

Internet Protocol version 4 is the fourth revision in the development of the Internet Protocol and the first version of the protocol to be widely deployed. Together with IPv6, it is at the core of standards-based internetworking methods of the Internet...

 and IPv6

IPv6

Internet Protocol version 6 is a version of the Internet Protocol . It is designed to succeed the Internet Protocol version 4...

 hosts to perform name resolution for hosts on the same local link. It is included in Windows Vista

Windows Vista

Windows Vista is an operating system released in several variations developed by Microsoft for use on personal computers, including home and business desktops, laptops, tablet PCs, and media center PCs...

, Windows Server 2008 and Windows 7.

Protocol details

In responding to queries, responders listen on UDP

User Datagram Protocol

The User Datagram Protocol is one of the core members of the Internet Protocol Suite, the set of network protocols used for the Internet. With UDP, computer applications can send messages, in this case referred to as datagrams, to other hosts on an Internet Protocol network without requiring...

 port 5355 on the following link-scope Multicast address

Multicast address

A multicast address is a logical identifier for a group of hosts in a computer network, that are available to process datagrams or frames intended to be multicast for a designated network service...

:

• IPv4 - 224.0.0.252, MAC address
  MAC address
  A Media Access Control address is a unique identifier assigned to network interfaces for communications on the physical network segment. MAC addresses are used for numerous network technologies and most IEEE 802 network technologies, including Ethernet...
  
   of 01-00-5E-00-00-FC
• IPv6 - FF02:0:0:0:0:0:1:3 (this notation can be abbreviated as FF02::1:3)

The responders also listen on TCP

Transmission Control Protocol

The Transmission Control Protocol is one of the core protocols of the Internet Protocol Suite. TCP is one of the two original components of the suite, complementing the Internet Protocol , and therefore the entire suite is commonly referred to as TCP/IP...

 port 5355 on the unicast

Unicast

right|200pxIn computer networking, unicast transmission is the sending of messages to a single network destination identified by a unique address.-Addressing methodologies:...

address that the host uses to respond to queries.

Packet header structure

EWLINE Bit offset 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 ID 16 QR Opcode C TC T Z Z Z Z RCODE 32 QDCOUNT 48 ANCOUNT 64 NSCOUNT 80 ARCOUNT

• ID - A 16-bit identifier assigned by the program that generates any kind of query.
• QR - Query/Response.
• OPCODE - A 4-bit field that specifies the kind of query in this message. This value is set by the originator of a query and copied into the response. This specification defines the behavior of standard queries and responses (opcode value of zero). Future specifications may define the use of other opcodes with LLMNR.
• C - Conflict.
• TC - TrunCation.
• T - Tentative.
• Z - Reserved for future use.
• RCODE - Response code.
• QDCOUNT - An unsigned 16-bit integer specifying the number of entries in the question section.
• ANCOUNT - An unsigned 16-bit integer specifying the number of resource records in the answer section.
• NSCOUNT - An unsigned 16-bit integer specifying the number of name server resource records in the authority records section.
• ARCOUNT - An unsigned 16-bit integer specifying the number of resource records in the additional records section.

External links

• TechNet Link-Local Multicast Name Resolution
• RFC 4795, Informational, Link-Local Multicast Name Resolution (LLMNR)