Standards/Ethernet/Bonjour

Bonjour is Apple's protocol for service discovery. It is lightweight and works over UDP. Bonjour implements a Multicast Domain Name System (mDNS) service without requiring a conventional DNS server.

Bonjour comprises:

• host discovery: finding the IP addresses of .local devices
• service discovery: listing the capabilities of the devices

Bonjour is implemented in Linux systems under the name Avahi. There is also a Windows implementation of Bonjour.

Multicast frames

For Ethernet, multicast MAC addresses range from 01:00:5E:00:00:00 to 01:00:5E:7F:FF:FF. In IPv4, multicast IP addresses range from 224.0.0.0 through 239.255.255.255. The 23 low order bits of the multicast MAC address are mapped directly to the 23 low order bits in the multicast IPv4 address.

The mDNS frames are sent to the multicast address 01:00:5E:00:00:FB / 224.0.0.251, from and to port 5353.

Bonjour frames can be filtered in Wireshark with the help of the expression:

ip.version==4 and udp.port==5353

The frame structure is based on the DNS packet format. It is built out of 2 parts: header and data.

offset (bytes)	0	1
0	ID = 0x0000
2	Flags
4	QDCOUNT (questions)
6	ANCOUNT (answers)
8	NSCOUNT (authority)
10	ARCOUNT (additional)
12	Data

The flags are all 0 except for:

• the first bit, Query/Response (QR), which is 0 for a query and 1 for a response
• the sixth bit, Authoritative Answer (AR), which is equal to the bit QR

The data is the UTF-8 list of the parts of the name preceded by the length of the item. In a question, the name is terminated with a 0x00 and followed by QTYPE which is 0x0001 for a host address, and QCLASS which is 0x0001 for Internet.

Host discovery

Query

Typing in a terminal:

ping fpga1.diploma.local

causes the computer to send the following mDNS query:

01 00 5e 00 00 fb 00 23  32 b1 21 52 08 00 45 00
00 41 e6 9d 00 00 ff 11  00 00 99 6d 05 a0 e0 00
00 fb 14 e9 14 e9 00 2d  80 47 00 00 00 00 00 01
00 00 00 00 00 00 05 66  70 67 61 31 07 64 69 70
6c 6f 6d 61 05 6c 6f 63  61 6c 00 00 01 00 01 

This frame contains Ethernet header:

01 00 5e 00 00 fb 00 23  32 b1 21 52 08 00

IP header:

                                           45 00
00 41 e6 9d 00 00 ff 11  00 00 99 6d 05 a0 e0 00
00 fb

UDP header:

      14 e9 14 e9 00 2d  80 47

and mDNS payload:

                               00 00 00 00 00 01
00 00 00 00 00 00 05 66  70 67 61 31 07 64 69 70
6c 6f 6d 61 05 6c 6f 63  61 6c 00 00 01 00 01

The payload says:

• Transaction Id: 0000
• Flags: 0000 (standard query)
• Questions: 0001
• Answer RRs: 0000
• Authority RRs: 0000
• Additional RRs: 0000
• Query:
  • 05 bytes fpga1
  • 07 bytes diploma
  • 05 bytes local
  • QTYPE: 0001 (host address)
  • QCLASS: 0001 (question: false, class: in)

Answer

To this, the selected device should respond: