Homeassistant sends out 5353 UDP multicast more than 100 times/minute

Configuration
1

Just noticed that my Homeassistant (ha core) running on an RPi5, broadcasts to port 5353 more than 100 times/minute.

I assume this is part of Bonjour/Avahi network discover but this shouldn’t be happening at such high frequency. Also, this behavior seems to only have started recently (but I can’t say for sure)

The syslog on one of my Linux machines shows multiple repeated entries of the following form generated by iptables:

Apr  9 14:26:13 mymachine kernel: [19278526.728209] KNOWN Local IP:: IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:yy:yy:yy:yy:yy:yy:08:00 SRC=nnn.nnn.nnn.nnn DST=224.0.0.251 LEN=206 TOS=0x00 PREC=0x00 TTL=255 ID=18831 PROTO=UDP SPT=5353 DPT=5353 LEN=186

My current iptables setup blocks high frequency UDP 5353 requests as a potential attack so this results in the Homeassistant RPi5 being blocked

  • Any idea why Bonjour/Avahi is multicasting more than 100 times/minute?
  • What can I do to fix this on the HA side? (I know I can change iptables to ignore such abuse but I want to fix the root cause)
2

It is how the protocol works, so the root cause is the iptables not being configured properly.

3

I have dozens of Linux, Windows, iPhone, Android and RPi devices on my network and none of them broadcast on 5353 anywhere near 100 times a minute. More like a couple of times an hour.

There appears to be something different/wrong with Home Assistant that makes it attempt Network discovery so frequently. After all, does one expect the network config to change multiple times a second???

Iptables IS CONFIGURED PROPERLY AND INTENTIONALLY SO – it is set up to block exploits that try to flood 5353 multicasts Sending out 5353 multicasts more than 100 times a minute fits that definition.

4

Mentioning hardware and OSes makes no sense here.
MDNS is a service, so what are you running on that list that makes use of mDNS?

Your IPTables rules might make sense for a basic simple consumer network, but it does not take into account an IoT network, which device countwise more looks like an enterprise network.
You need to understand the services and protocols in your network and how they are used to set up restriktive rules for them!

You can of course decide to run HA supervised and then limit the mDNS packets there, but when a sensor miss a discovery request, then it will be unavailable in HA until the sensor itself sends a announcement broadcast.
As you can see on your other devices this might mean several hours without updates.

5

Yes but sending out requests ~200 times a minute seems excessive.

Note that per the RFC 6762 for mDNS, it should never multicast its own identity more than once per second. So, HA seems to be violating the mDNS RFC

And if it’s querying for other devices, I only have a couple of IoT devices on my network and it should at least be caching their IP addresses rather than requerying every second. If I had hundreds of IoT devices this would be killing my WiFi network with thousands of useless mDNS packets a second (this is a real problem on large public WiFi networks where even mDNS packets a couple times a minute can cause problems)

Also, it only seems to have started doing this in the last few days and not sure what changed to cause the issue as I don’t think I did anything to HA recently.

I also have Google Home and Alexa on my network that are attached to the very same IoT devices (actually more) and they multicast 5353 only a few times an hours.

So something seems broken or at least changed.

Also, my iptables is not on the HomeAssistant device but on my home server. It is getting flooded by mDNS from the RPi5 running Home Assistant. Note that a regular RPi running Raspbian only sends out a handful of mDNS requests per minute vs. ~200 for HomeAssistant.

6

mDNS can flood large corporation network with many thousand of devices, so you normally segment the networks then.
We have around 5000-6000 devices per segment at my work at in handle it fine.
Your network gear should do fine too or it will be crap.
A mDNS packet is based on UDP and most packets that come from HA are service discoveries, which is pretty close to the minimum UDP packet size of around 60 bytes. A common packet size when you stream a movie will be 1500 bytes and the packet counts per minute of those will be higher than any mDNS count you can experience on a home network.

You should put a packet grabber, like wireshark, on your network and see what the traffic actually is.
mDNS is not just a decentralized name lookup service, nor is DNS inside LANs anymore.

1 Like
7

Wireshark was a great idea!

It seems like they are almost all “QU” or “QM” queries to my MythTV boxes.
e.g.,

323	77.211601	192.168.1.123	224.0.0.251	MDNS	120	Standard query 0x0000 SRV MythTV1 on mymachine.mydomain._airplay._tcp.local, "QU" question A MythTV1 on consult.pretender._airplay._tcp.local, "QU" question AAAA MythTV1 on consult.pretender._airplay._tcp.local, "QU" question
327	77.415332	192.168.1.123	224.0.0.251	MDNS	120	Standard query 0x0000 SRV MythTV1 on mymachine.mydomain._airplay._tcp.local, "QM" question A MythTV1 on consult.pretender._airplay._tcp.local, "QM" question AAAA MythTV1 on consult.pretender._airplay._tcp.local, "QM" question
341	80.181382	192.168.1.123	224.0.0.251	MDNS	119	Standard query 0x0000 SRV MythTV on mymachine.mydomain._airplay._tcp.local, "QU" question A MythTV on consult.pretender._airplay._tcp.local, "QU" question AAAA MythTV on consult.pretender._airplay._tcp.local, "QU" question
345	80.487428	192.168.1.123	224.0.0.251	MDNS	119	Standard query 0x0000 SRV MythTV on mymachine.mydomain._airplay._tcp.local, "QM" question A MythTV on consult.pretender._airplay._tcp.local, "QM" question AAAA MythTV on consult.pretender._airplay._tcp.local, "QM" question

Though Mythtv is not in my integrations so not sure why it is doing this…
None of my other Linux/Windows/RPi/Android boxes seem to be querying mythtv.

Any idea why this is happening?
Can I shut it off?

8

QU and QM just tells you what type of query it is, like multicast or unicast. Not what the actual query is.

This holds some descriptions on basic events in a mDNS network.

9

The mdns packets all include _airplay._tcp.local
I wonder whether HA is detecting the mythtv instances as an airplay device and is interacting with it that way.

Is airplay part of HA? Is it possible to turn it off?

10

HA most likely support the airplay protocol also, but airplay can also just be a standard service thing in mDNS also.
mDNS is an apple thing turned general.