Observe the packet details in the middle Wireshark packet details pane.Select the second LLMNR packet labeled Standard query.Expand Link-local Multicast Name Resolution (query) to view LLMNR details.Īctivity 3 - Analyze LLMNR IPv4 Traffic.

Notice that it is a dynamic port selected for this LLMNR query.

Expand User Datagram Protocol to view UDP details.

Notice that the destination address is the LLMNR multicast IPv6 address ff02::1:3. Notice that the source address is your link-local IPv6 address.

Expand Internet Protocol Version 6 to view IPv6 details.

You can use ipconfig /all and netsh interface ipv6 show neighbors to confirm. The destination should be the LLMNR IPv6 multicast MAC address 33:33:00:01:00:03 and the source should be your MAC address.

Observe the Destination and Source fields.

Expand Ethernet II to view Ethernet details.

Notice that it is an Ethernet II / Internet Protocol Version 6 / User Datagram Protocol / Link-local Multicast Name Resolution (query) frame.

Select the first LLMNR packet labeled Standard query.

To view only LLMNR traffic, type udp.port = 5355 (lower case) in the Filter box and press Enter.

Observe the traffic captured in the top Wireshark packet list pane.

An unknown host name is used for this activity because names resolved by DNS will not generate LLMNR traffic.Īctivity 2 - Analyze LLMNR IPv6 Traffic

Type ping, where is any unknown host name on your network.

Wikipedia: Link-local Multicast Name ResolutionĪctivity 1 - Capture LLMNR Traffic.

These activities will show you how to use Wireshark to capture and analyze Link-Local Multicast Name Resolution (LLMNR) traffic.

Wireshark is a free and open source packet analyzer used for network troubleshooting and analysis. 5 Activity 3 - Analyze LLMNR IPv4 Traffic.

4 Activity 2 - Analyze LLMNR IPv6 Traffic.

Wireshark dns filter