Standards/Ethernet/Bonjour
(→Multicast frames) |
(→Answer) |
||
(11 intermediate revisions by 4 users not shown) | |||
Line 12: | Line 12: | ||
There is also a [http://www.apple.com/support/bonjour/ Windows implementation] of Bonjour. | There is also a [http://www.apple.com/support/bonjour/ Windows implementation] of Bonjour. | ||
− | == | + | == mDNS frames == |
− | The mDNS frames are sent to the multicast address <code>01:00:5E:00:00:FB</code> / <code>224.0.0.251</code>, from and to port <code>5353</code>. | + | The mDNS [[Standards/Ethernet#Multicast|multicast frames]] are sent to the multicast address <code>01:00:5E:00:00:FB</code> / <code>224.0.0.251</code>, from and to port <code>5353</code>. |
− | Bonjour frames | + | Bonjour frames can be filtered in [http://www.wireshark.org/ Wireshark] with the help of the expression: |
ip.version==4 and udp.port==5353 | ip.version==4 and udp.port==5353 | ||
Line 35: | Line 35: | ||
|- | |- | ||
! 4 | ! 4 | ||
− | | colspan="2" | QDCOUNT | + | | colspan="2" | QDCOUNT (questions) |
|- | |- | ||
! 6 | ! 6 | ||
− | | colspan="2" | ANCOUNT | + | | colspan="2" | ANCOUNT (answers) |
|- | |- | ||
! 8 | ! 8 | ||
− | | colspan="2" | NSCOUNT | + | | colspan="2" | NSCOUNT (authority) |
|- | |- | ||
! 10 | ! 10 | ||
− | | colspan="2" | ARCOUNT | + | | colspan="2" | ARCOUNT (additional) |
|- | |- | ||
! 12 | ! 12 | ||
Line 73: | Line 73: | ||
6c 6f 6d 61 05 6c 6f 63 61 6c 00 00 01 00 01 | 6c 6f 6d 61 05 6c 6f 63 61 6c 00 00 01 00 01 | ||
− | This frame contains Ethernet header: | + | This frame contains the Ethernet header, with multicast destination MAC address <code>01:00:5E:00:00:FB</code>: |
01 00 5e 00 00 fb 00 23 32 b1 21 52 08 00 | 01 00 5e 00 00 fb 00 23 32 b1 21 52 08 00 | ||
− | IP header: | + | IP header, with multicast IP address <code>224.0.0.251</code> (<code>E0:00:00:FB</code>): |
45 00 | 45 00 | ||
00 41 e6 9d 00 00 ff 11 00 00 99 6d 05 a0 e0 00 | 00 41 e6 9d 00 00 ff 11 00 00 99 6d 05 a0 e0 00 | ||
Line 88: | Line 88: | ||
00 00 00 00 00 01 | 00 00 00 00 00 01 | ||
00 00 00 00 00 00 05 66 70 67 61 31 07 64 69 70 | 00 00 00 00 00 00 05 66 70 67 61 31 07 64 69 70 | ||
− | 6c 6f 6d 61 05 6c 6f 63 61 6c 00 00 01 00 01 | + | 6c 6f 6d 61 05 6c 6f 63 61 6c 00 00 01 00 01 |
+ | |||
+ | The payload says: | ||
+ | * Transaction Id: <code>0000</code> | ||
+ | * Flags: <code>0000</code> (standard query) | ||
+ | * Questions: <code>0001</code> | ||
+ | * Answer RRs: <code>0000</code> | ||
+ | * Authority RRs: <code>0000</code> | ||
+ | * Additional RRs: <code>0000</code> | ||
+ | * Query: | ||
+ | ** <code>05</code> bytes <code>fpga1</code> | ||
+ | ** <code>07</code> bytes <code>diploma</code> | ||
+ | ** <code>05</code> bytes <code>local</code> | ||
+ | ** QTYPE: <code>0001</code> (host address) | ||
+ | ** QCLASS: <code>0001</code> (question: false, class: in) | ||
=== Answer === | === Answer === | ||
+ | To this, the selected device should respond: | ||
+ | Note that it's not a response to the Bonjour Discovery above. | ||
+ | |||
+ | |||
+ | 01 00 5e 00 00 fb 00 26 2d ab 9f 04 08 00 45 00 | ||
+ | 00 48 00 00 40 00 ff 11 6a f6 c0 a8 6f 0a e0 00 | ||
+ | 00 fb 14 e9 14 e9 00 34 10 f4 00 00 84 00 00 00 | ||
+ | 00 01 00 00 00 00 0a 6c 61 70 74 6f 70 41 63 65 | ||
+ | 72 05 6c 6f 63 61 6c 00 00 01 80 01 00 00 00 78 | ||
+ | 00 04 c0 a8 6f 0a | ||
+ | |||
+ | This frame contains Ethernet header: | ||
+ | |||
+ | 01 00 5e 00 00 fb 00 26 2d ab 9f 04 08 00 | ||
+ | |||
+ | IP header: | ||
+ | 45 00 | ||
+ | 00 48 00 00 40 00 ff 11 6a f6 c0 a8 6f 0a e0 00 | ||
+ | 00 fb | ||
+ | |||
+ | UDP header: | ||
+ | 14 e9 14 e9 00 34 10 f4 | ||
+ | |||
+ | and mDNS payload: | ||
+ | 00 00 84 00 00 00 | ||
+ | 00 01 00 00 00 00 0a 6c 61 70 74 6f 70 41 63 65 | ||
+ | 72 05 6c 6f 63 61 6c 00 00 01 80 01 00 00 00 78 | ||
+ | 00 04 c0 a8 6f 0a | ||
− | + | The payload says: | |
+ | * Transaction Id: <code>0000</code> | ||
+ | * Flags: <code>8400</code> (Standart query response, no error) | ||
+ | * Questions: <code>0000</code> | ||
+ | * Answer RRs: <code>0001</code> | ||
+ | * Authority RRs: <code>0000</code> | ||
+ | * Additional RRs: <code>0000</code> | ||
+ | * Answer: | ||
+ | ** <code>0a</code> bytes <code>laptopAcer</code> | ||
+ | ** <code>05</code> bytes <code>local</code> | ||
+ | ** <code>00</code> string delimiter | ||
+ | ** TYPE: <code>0001</code> (type A) | ||
+ | ** CLASS: <code>8001</code> (cache flush: True, class: in) | ||
+ | ** TTL: <code>00 00 00 78</code> (Time to live: 2 minutes) | ||
+ | ** Data length: <code>0004</code> (length: 4) | ||
+ | ** Addr: <code>c0 a8 6f 0a</code> (192.168.111.10) | ||
[[Category:Standards]] [[Category:Ethernet]] | [[Category:Standards]] [[Category:Ethernet]] |
Latest revision as of 11:11, 2 July 2015
|
Bonjour is Apple's protocol for service discovery. It is lightweight and works over UDP. Bonjour implements a Multicast Domain Name System (mDNS) service without requiring a conventional DNS server.
Bonjour comprises:
- host discovery: finding the IP addresses of
.local
devices - service discovery: listing the capabilities of the devices
Bonjour is implemented in Linux systems under the name Avahi. There is also a Windows implementation of Bonjour.
mDNS frames
The mDNS multicast frames are sent to the multicast address 01:00:5E:00:00:FB
/ 224.0.0.251
, from and to port 5353
.
Bonjour frames can be filtered in Wireshark with the help of the expression:
ip.version==4 and udp.port==5353
The frame structure is based on the DNS packet format. It is built out of 2 parts: header and data.
offset (bytes) | 0 | 1 |
---|---|---|
0 | ID = 0x0000 | |
2 | Flags | |
4 | QDCOUNT (questions) | |
6 | ANCOUNT (answers) | |
8 | NSCOUNT (authority) | |
10 | ARCOUNT (additional) | |
12 | Data |
The flags are all 0
except for:
- the first bit, Query/Response (QR), which is
0
for a query and1
for a response - the sixth bit, Authoritative Answer (AR), which is equal to the bit QR
The data is the UTF-8 list of the parts of the name preceded by the length of the item.
In a question, the name is terminated with a 0x00 and followed by QTYPE
which is 0x0001 for a host address, and QCLASS
which is 0x0001 for Internet.
Host discovery
Query
Typing in a terminal:
ping fpga1.diploma.local
causes the computer to send the following mDNS query:
01 00 5e 00 00 fb 00 23 32 b1 21 52 08 00 45 00 00 41 e6 9d 00 00 ff 11 00 00 99 6d 05 a0 e0 00 00 fb 14 e9 14 e9 00 2d 80 47 00 00 00 00 00 01 00 00 00 00 00 00 05 66 70 67 61 31 07 64 69 70 6c 6f 6d 61 05 6c 6f 63 61 6c 00 00 01 00 01
This frame contains the Ethernet header, with multicast destination MAC address 01:00:5E:00:00:FB
:
01 00 5e 00 00 fb 00 23 32 b1 21 52 08 00
IP header, with multicast IP address 224.0.0.251
(E0:00:00:FB
):
45 00 00 41 e6 9d 00 00 ff 11 00 00 99 6d 05 a0 e0 00 00 fb
UDP header:
14 e9 14 e9 00 2d 80 47
and mDNS payload:
00 00 00 00 00 01 00 00 00 00 00 00 05 66 70 67 61 31 07 64 69 70 6c 6f 6d 61 05 6c 6f 63 61 6c 00 00 01 00 01
The payload says:
- Transaction Id:
0000
- Flags:
0000
(standard query) - Questions:
0001
- Answer RRs:
0000
- Authority RRs:
0000
- Additional RRs:
0000
- Query:
-
05
bytesfpga1
-
07
bytesdiploma
-
05
byteslocal
- QTYPE:
0001
(host address) - QCLASS:
0001
(question: false, class: in)
-
Answer
To this, the selected device should respond: Note that it's not a response to the Bonjour Discovery above.
01 00 5e 00 00 fb 00 26 2d ab 9f 04 08 00 45 00 00 48 00 00 40 00 ff 11 6a f6 c0 a8 6f 0a e0 00 00 fb 14 e9 14 e9 00 34 10 f4 00 00 84 00 00 00 00 01 00 00 00 00 0a 6c 61 70 74 6f 70 41 63 65 72 05 6c 6f 63 61 6c 00 00 01 80 01 00 00 00 78 00 04 c0 a8 6f 0a
This frame contains Ethernet header:
01 00 5e 00 00 fb 00 26 2d ab 9f 04 08 00
IP header:
45 00 00 48 00 00 40 00 ff 11 6a f6 c0 a8 6f 0a e0 00 00 fb
UDP header:
14 e9 14 e9 00 34 10 f4
and mDNS payload:
00 00 84 00 00 00 00 01 00 00 00 00 0a 6c 61 70 74 6f 70 41 63 65 72 05 6c 6f 63 61 6c 00 00 01 80 01 00 00 00 78 00 04 c0 a8 6f 0a
The payload says:
- Transaction Id:
0000
- Flags:
8400
(Standart query response, no error) - Questions:
0000
- Answer RRs:
0001
- Authority RRs:
0000
- Additional RRs:
0000
- Answer:
-
0a
byteslaptopAcer
-
05
byteslocal
-
00
string delimiter - TYPE:
0001
(type A) - CLASS:
8001
(cache flush: True, class: in) - TTL:
00 00 00 78
(Time to live: 2 minutes) - Data length:
0004
(length: 4) - Addr:
c0 a8 6f 0a
(192.168.111.10)
-