3

Why does systemd-resolved from systemd version 219 listen on one random UDP port?

One of my machines listens on port 58557 (CentOS 7 with systemd version 219).

sudo netstat -tunlp|grep -P '^Active|^Proto|systemd'
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address  Foreign Address  State  PID/Program name
udp        0      0 0.0.0.0:58557  0.0.0.0:*               372/systemd-resolve

Another machine listens on port 52010 (also CentOS 7 with systemd version 219).

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address  Foreign Address  State  PID/Program name
udp      768      0 0.0.0.0:52010  0.0.0.0:*               398/systemd-resolve

Once I reboot the machines, systemd-resolved listens on another UDP port.

I have a third machine, which runs Fedora 27 with systemd version 234. Here, systemd does not open a random UDP port.

As a side note, I have disabled LLMNR, both in /etc/systemd/network/20-eth0.network and /etc/systemd/network/20-eth0.network, so this can't be it. Also, LLMNR would open port 5355.

$ grep LLMNR /etc/systemd/resolved.conf
LLMNR=no
$ grep LLMNR /etc/systemd/network/20-eth0.network
LLMNR=no
3
  • I checked on Ubuntu 17.10 with systemd version 234. Here, systemd-resolved listens on port 5355. Running nmap against the port identifies it was llmnr, matching your expectations. – Mark Stosberg Apr 16 '18 at 20:36
  • If you are worried, you can launch a known-good copy of CentOS 7 with systemd 219 and see if the default behavior differs from what your box is is doing. – Mark Stosberg Apr 16 '18 at 20:52
  • 1
    I ran systemd-resolved as an argument to strace. I noticed that the UDP port is not open from the start. It is only listed in netstat, once the first request to resolve a DNS name is done. My current guess is that the port is the port at which systemd-resolved receives the response. – Peter Andersson Apr 17 '18 at 7:37
4

As I mentioned in a comment to the question, I ran systemd-resolved in strace, while watch[ing] netstat -tunlp. I noticed that the port is only opened once I make the first request to resolve a DNS name.

I captured the traffic using tcpdump -i eth0 -nn -w capture_file, noted down the port I see in netstat and looked at the output using Wireshark. The filter in Wireshark is simple: udp.port eq 37078 (using the previously noted down udp port).

I can confirm that the UDP port that is being opened by systemd-resolved is the port that is used to communicate with the DNS server.

2
  • 1
    Good investigation. It would be nice if this behavior was documented somewhere. For example man systemd-resolved mentions nothing about listening on a random port. – Mark Stosberg Apr 17 '18 at 13:40
  • 1
    It's not listening, that not being meaningful for UDP for starters; and this is normal behaviour for proxy DNS servers. They make back-end transactions with other servers, and use one or more UDP ports for that. – JdeBP Apr 17 '18 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.