I am in a network and a user is sending broadcast messages on udp port 5353. Regardless of what that is and what their purpose is, I decided to block all the traffic, so I ran:sudo iptables -A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 5353 -j DROPBut I am still getting the traffic (in wireshark), but with different source and destinations (neither the source nor the destination matches my IP). Apparently I need a mechanism to drop the broadcasts, is there any way of doing that using iptables or ufw?
How to block broadcast messages (Apple's mDNS traffic)
iptables;udp;multicast;mdns
UDP cannot have state - try without the state clause.Also, be aware that if you are checking incoming traffic with tcpdump, this listens OUTSIDE the firewall.