Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking at a tcpdump of my network and seeing floods of mdns packets from my W2k3 AD Server. :

03:28:30.655189 IP mydomainserver.local.mdns > 0*- [0q] 1/0/0 A (40)

Why is it doing this and how can I stop it?

share|improve this question
up vote 1 down vote accepted

This is from installed software (which is a little concerning on a domain controller).

Check through Add/Remove Programs, and get rid of anything that shouldn't be there.

More info on multicast DNS here.

share|improve this answer
As Shane says, this is Bonjour/mDNS. It's doing it because someone installed it, and you stop it by not installing stuff on your domain controllers unless you understand what it does. – RobM May 17 '11 at 16:19
Exactly right. Turned out to be a server product which uses Bonjour. – Frank Brenner May 30 '11 at 10:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.