28

I am using chromium browser (chrome) with pepperflashplugin in Debian. I have noticed, chromium/pepperflashplugin opens a listening port on my public interface 0.0.0.0:5353 as seen with netstat:

netstat -lptun
Proto  Recv-Q  Send-Q  Local Address  Foreign Address  State  PID/Program name     
udp         0       0  0.0.0.0:5353   0.0.0.0:*               13971/libpepflashpl

I have been using Firefox (Iceweasel) before and I have never seen browser/flash-plugin to open ports. Indeed, I have never seen any client application opening listening ports on 0.0.0.0.

Why is chromium doing this?

Is this necessary ?

Can I disable this?

Can I start chromium with pepperflashplugin disabled ?

  • 4
    For UDP netstat doesn't show if a socket is output or input or both; the LISTEN state is only for TCP. 0.0.0.0 for local address (or IPv6 ::0 aka ::) means "any address" and is quite common for most programs except those which respond differently on different addresses such as web servers (and, oddly, ntpd), and some programs that use loopback to talk to themselves (only). Port 5353 is nominally mDNS, but you could check actual packet contents with wireshark or similar; in any case I don't know why flash should be using it. – dave_thompson_085 Mar 1 '15 at 1:39
14

I noticed this issue when I check for local listening ports with ss -utln before Google brought me here.

My first thought of disabling this is to take a look at chrome://flags. And I found this: chrome://flags/#device-discovery-notifications

Disabling this so-called "device discovery" feature turns off listening of mDNS port 5353/tcp. You need to relaunch Chromium / Google Chrome to make this take effect.

8

It seems those ports are Chromium's attempt at discovering local web servers announced through the Zeroconf protocol, specifically the Multicast DNS protocol. Basically, it means that if a web server on the local network exist, Chromium will notice it and pop out a notification. This has been known to trigger warnings in Windows so it is disabled there by default, yet it is unclear how to disable this directly.

8

On Linux with Chrome version 56.0.2924.87 (64-bit) setting the device-discovery-notification flag to Disabled and relaunching does not disable the listening port 5353

I also tried sudo apt-get purge avahi-daemon avahi-autoipd

Also tried /opt/google/chrome/chrome --disable-device-discovery-notifications

No luck, it appears the current version of Chrome no longer honors the flag/cmd line option and always listens on the port.

Using a firewall maybe the only way to block this port.

Using a firewall may require blocking on multicast IPs as well.

How to Block Apple Bonjour on your Local Network

  • 3
    When I answered this question in 2016, Cr honored the chrome://flag settings. Today I found out that it did not honor the flag any longer, when I was trying to start an alternative DNS daemon listening on 5353/tcp. – Zhuoyun Wei Jan 19 '18 at 15:20
3

I have to disagree with @dave_thompson_085 on this. To me this is clearly a listening socket since the local address is specified and the foreign address is set to any:any. In other words the local system is waiting for udp datagrams incoming to port 5353 on any interface and from any port on any foreign IP address.

This is supported by netstat itself using the -l switch for 'listening' or not as follows:

# netstat -lnup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           4827/chromium --pas
# netstat -nup
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name

However, what Chromium is up to is not something I can answer yet - it's actually how I ended up here myself :)

  • a bit of information about this (possibly unwanted) feature can found at google's bugtracker, but it's still not clear what exactly it's for – Tomáš Pospíšek Dec 25 '17 at 16:58
3

To disable mDNS and SSDP you now have to create a policy. Please note "Policy configuration files live under /etc/chromium for Chromium, and under /etc/opt/chrome for Google Chrome."

For Chromium the file /etc/chromium/policies/managed/name_your_policy.json should contain

{ "EnableMediaRouter": false }

For more info see. https://www.chromium.org/administrators/linux-quick-start And also bugs https://bugs.chromium.org/p/chromium/issues/detail?id=859359 https://bugs.chromium.org/p/chromium/issues/detail?id=665572

  • This worked with my Chrome 70.0.3538.77 on 2018-11-09 – Dmitriy Sukharev Nov 10 '18 at 6:38
1

Go to Chrome (or Chromium) Settings -> Advanced Settings -> Google Cloud Print and disable "Show notifications when new printers are detected on the network"

  • It had been already disabled, did not help – chevallier Sep 25 '18 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.