UNDER THE HOOD
How BoltMate talks to your other computers
Last updated 2026-10-12
When you switch computers, BoltMate on that computer tells BoltMate on your other computers, and they move the rest of your devices over. All of that happens on your local network. This page is for anyone who wants the details: the ports to open, how the machines find each other, and what leaves your network.
Ports and protocols
| Port | Protocol | Used for | Required |
|---|---|---|---|
| 41420 | UDP broadcast | Finding the other computers, and announcing switches | Yes |
| 41420 on 239.255.41.42 | UDP multicast | The same announcements, for networks that filter broadcast | No |
| 41421 | TCP | A faster, acknowledged channel between computers, and gathering logs from your other computers when you contact support | No |
| 5353 on 224.0.0.251 | mDNS (Bonjour) | A second way to find the other computers | No |
Only UDP port 41420 is required. With just that open, switching works. The other three make it faster and more robust when your network allows them.
How a switch reaches your other computers
- Every computer announces itself. Every 2 seconds, each computer broadcasts which of your devices are connected to it. When a device moves, it sends updates every 200 ms for a few seconds. Each announcement is sent three times, so one dropped packet doesn't matter.
- Broadcast alone is enough. A switch is carried by these announcements, so it gets through even on networks that block TCP or Bonjour.
- TCP is a bonus. When TCP works, the computers also keep a direct connection for faster, acknowledged messages. Either computer can open it, and it works in both directions once open, so it only needs to get through the firewall one way.
- Two ways to find each other. Computers find each other through Bonjour, or through the broadcast announcements when Bonjour is blocked. An address learned from a broadcast is only trusted after the computer there proves it belongs to your account.
- The computers agree on where you are. Each switch carries a logical timestamp, so every computer independently reaches the same answer about which one you're using, without trusting anyone's clock.
Who can join, and encryption
- Only your own computers. Computers form a group only when they're signed in to the same BoltMate account. Your account holds a secret that a computer needs before it can join.
- Everything is encrypted. Announcements are encrypted with AES-GCM under a group key that your computers agree on with an authenticated key exchange. When a computer leaves the group, the remaining computers switch to a new key.
- Other traffic is ignored. Anything from another account, or from a computer that isn't signed in, fails to decrypt and is dropped. A computer that's signed out sends nothing.
What leaves your network
Switch events and device state never leave your local network. BoltMate contacts these servers only for the following:
| Server | Used for |
|---|---|
| boltmateauth.ciamlogin.com | Signing in |
| api.boltmate.app | Checking your license, and fetching the secret that lets your computers find each other |
| config.boltmate.app | Signed app configuration, such as the current version |
| downloads.boltmate.app | Downloading updates |
| *.applicationinsights.azure.com | Anonymous usage data, only if you opt in |
Network requirements
- Same local network. Your computers need to be on the same subnet. Broadcast doesn't cross routers, so separate VLANs, guest networks and most VPNs keep the computers from seeing each other. Wi-Fi and Ethernet on the same subnet work fine together.
- Firewall. Allow UDP 41420 at minimum, and TCP 41421 if you can. On Windows, allow BoltMate on private networks. On macOS, allow it under Privacy & Security, then Local Network.
- Nothing to configure. There are no IP addresses to enter and no pairing codes. Sign in on each computer and they find each other.
Checking the connection
In BoltMate, open Settings, then Status. The UDP and Sync rows show whether each channel is working and why not if it isn't. If you're stuck, send us a note and include your logs.