Получил недавно такую абузу:

Dear Sir or Madam,
>
> Multicast DNS (mDNS) is used for resolving host names to IP addresses
> within small networks that do not include a local DNS server. It is
> implemented for example by the Apple ‘Bonjour’ and Linux/BSD ‘Avahi’
> (nss-mdns) services. mDNS uses port 5353/udp.
>
> In addition to disclosing information about the system/network,
> mDNS services openly accessible from anywhere on the Internet can be
> abused for DDoS reflection attacks against third parties.
>
> Please find below a list of affected systems hosted on your network.
> The timestamp (timezone UTC) indicates when the openly accessible
> mDNS service was identified.
>
> We would like to ask you to check this issue and take appropriate
> steps to close the openly accessible mDNS services on the affected
> systems or notify your customers accordingly.
>
> If you have recently solved the issue but received this notification
> again, please note the timestamp included below. You should not
> receive any further notifications with timestamps after the issue
> has been solved.

Оказывается, на UDP порт 5353 слушал на всех интерфейсах avahi-daemon, который был установлен непонятно с чем (а может быть и по умолчанию в Linux Mint).

Смотрим, что слушает на этом порту:
netstat -tulpn |grep 5353
avahi-daemon

Побороть можно так следующим образом.

Проверяем зависимости, чаще всего avahi требует именно wine:

apt-rdepends wine | grep avahi

Если не нужен wine или зависимостей нет, то можно смело делать
apt-get remove avahi-daemon

Если нужен, то просто отключим:
update-rc.d avahi-daemon disable
/etc/init.d/avahi-daemon stop