Standards/Ethernet/Bonjour

From UIT
Jump to: navigation, search

Contents

Bonjour is Apple's protocol for service discovery. It is lightweight and works over UDP. Bonjour implements a Multicast Domain Name System (mDNS) service without requiring a conventional DNS server.

Bonjour comprises:

  • host discovery: finding the IP addresses of .local devices
  • service discovery: listing the capabilities of the devices

Bonjour is implemented in Linux systems under the name Avahi. There is also a Windows implementation of Bonjour.

mDNS frames

The mDNS multicast frames are sent to the multicast address 01:00:5E:00:00:FB / 224.0.0.251, from and to port 5353.

Bonjour frames can be filtered in Wireshark with the help of the expression:

ip.version==4 and udp.port==5353

The frame structure is based on the DNS packet format. It is built out of 2 parts: header and data.

offset (bytes) 0 1
0 ID = 0x0000
2 Flags
4 QDCOUNT (questions)
6 ANCOUNT (answers)
8 NSCOUNT (authority)
10 ARCOUNT (additional)
12  
Data
 

The flags are all 0 except for:

  • the first bit, Query/Response (QR), which is 0 for a query and 1 for a response
  • the sixth bit, Authoritative Answer (AR), which is equal to the bit QR

The data is the UTF-8 list of the parts of the name preceded by the length of the item. In a question, the name is terminated with a 0x00 and followed by QTYPE which is 0x0001 for a host address, and QCLASS which is 0x0001 for Internet.

Host discovery

Query

Typing in a terminal:

ping fpga1.diploma.local

causes the computer to send the following mDNS query:

01 00 5e 00 00 fb 00 23  32 b1 21 52 08 00 45 00
00 41 e6 9d 00 00 ff 11  00 00 99 6d 05 a0 e0 00
00 fb 14 e9 14 e9 00 2d  80 47 00 00 00 00 00 01
00 00 00 00 00 00 05 66  70 67 61 31 07 64 69 70
6c 6f 6d 61 05 6c 6f 63  61 6c 00 00 01 00 01 

This frame contains the Ethernet header, with multicast destination MAC address 01:00:5E:00:00:FB:

01 00 5e 00 00 fb 00 23  32 b1 21 52 08 00

IP header, with multicast IP address 224.0.0.251 (E0:00:00:FB):

                                           45 00
00 41 e6 9d 00 00 ff 11  00 00 99 6d 05 a0 e0 00
00 fb

UDP header:

      14 e9 14 e9 00 2d  80 47

and mDNS payload:

                               00 00 00 00 00 01
00 00 00 00 00 00 05 66  70 67 61 31 07 64 69 70
6c 6f 6d 61 05 6c 6f 63  61 6c 00 00 01 00 01

The payload says:

  • Transaction Id: 0000
  • Flags: 0000 (standard query)
  • Questions: 0001
  • Answer RRs: 0000
  • Authority RRs: 0000
  • Additional RRs: 0000
  • Query:
    • 05 bytes fpga1
    • 07 bytes diploma
    • 05 bytes local
    • QTYPE: 0001 (host address)
    • QCLASS: 0001 (question: false, class: in)

Answer

To this, the selected device should respond: Note that it's not a response to the Bonjour Discovery above.


01 00 5e 00 00 fb 00 26  2d ab 9f 04 08 00 45 00
00 48 00 00 40 00 ff 11  6a f6 c0 a8 6f 0a e0 00
00 fb 14 e9 14 e9 00 34  10 f4 00 00 84 00 00 00
00 01 00 00 00 00 0a 6c  61 70 74 6f 70 41 63 65
72 05 6c 6f 63 61 6c 00  00 01 80 01 00 00 00 78
00 04 c0 a8 6f 0a

This frame contains Ethernet header:

01 00 5e 00 00 fb 00 26  2d ab 9f 04 08 00 

IP header:

                                           45 00
00 48 00 00 40 00 ff 11  6a f6 c0 a8 6f 0a e0 00
00 fb

UDP header:

      14 e9 14 e9 00 34  10 f4

and mDNS payload:

                               00 00 84 00 00 00
00 01 00 00 00 00 0a 6c  61 70 74 6f 70 41 63 65
72 05 6c 6f 63 61 6c 00  00 01 80 01 00 00 00 78
00 04 c0 a8 6f 0a

The payload says:

  • Transaction Id: 0000
  • Flags: 8400 (Standart query response, no error)
  • Questions: 0000
  • Answer RRs: 0001
  • Authority RRs: 0000
  • Additional RRs: 0000
  • Answer:
    • 0a bytes laptopAcer
    • 05 bytes local
    • 00 string delimiter
    • TYPE: 0001 (type A)
    • CLASS: 8001 (cache flush: True, class: in)
    • TTL: 00 00 00 78 (Time to live: 2 minutes)
    • Data length: 0004 (length: 4)
    • Addr: c0 a8 6f 0a (192.168.111.10)
Personal tools
Namespaces
Variants
Actions
Navigation
Browse
Toolbox