Standards/Ethernet/Bonjour
(→Multicast frames) |
(→Query) |
||
Line 88: | Line 88: | ||
00 00 00 00 00 01 | 00 00 00 00 00 01 | ||
00 00 00 00 00 00 05 66 70 67 61 31 07 64 69 70 | 00 00 00 00 00 00 05 66 70 67 61 31 07 64 69 70 | ||
− | 6c 6f 6d 61 05 6c 6f 63 61 6c 00 00 01 00 01 | + | 6c 6f 6d 61 05 6c 6f 63 61 6c 00 00 01 00 01 |
+ | |||
+ | The payload says: | ||
+ | * Transaction Id: <code>0000</code> | ||
+ | * Flags: <code>0000</code> (standard query) | ||
+ | * Questions: <code>0001</code> | ||
+ | * Answer RRs: <code>0000</code> | ||
+ | * Authority RRs: <code>0000</code> | ||
+ | * Additional RRs: <code>0000</code> | ||
+ | * Query: | ||
+ | ** <code>05</code> bytes <code>fpga1</code> | ||
+ | ** <code>07</code> bytes <code>diploma</code> | ||
+ | ** <code>05</code> bytes <code>local</code> | ||
+ | * QTYPE: <code>0001</code> (host address) | ||
+ | * QCLASS: <code>0000</code> | ||
=== Answer === | === Answer === |
Revision as of 14:51, 5 June 2012
|
Bonjour is Apple's protocol for service discovery. It is lightweight and works over UDP. Bonjour implements a Multicast Domain Name System (mDNS) service without requiring a conventional DNS server.
Bonjour comprises:
- host discovery: finding the IP addresses of
.local
devices - service discovery: listing the capabilities of the devices
Bonjour is implemented in Linux systems under the name Avahi. There is also a Windows implementation of Bonjour.
Multicast frames
The mDNS frames are sent to the multicast address 01:00:5E:00:00:FB
/ 224.0.0.251
, from and to port 5353
.
Bonjour frames are filtered in Wireshark with the help of the expression:
ip.version==4 and udp.port==5353
The frame structure is based on the DNS packet format. It is built out of 2 parts: header and data.
offset (bytes) | 0 | 1 |
---|---|---|
0 | ID = 0x0000 | |
2 | Flags | |
4 | QDCOUNT (questions) | |
6 | ANCOUNT (answers) | |
8 | NSCOUNT (authority) | |
10 | ARCOUNT (additional) | |
12 | Data |
The flags are all 0
except for:
- the first bit, Query/Response (QR), which is
0
for a query and1
for a response - the sixth bit, Authoritative Answer (AR), which is equal to the bit QR
The data is the UTF-8 list of the parts of the name preceded by the length of the item.
In a question, the name is terminated with a 0x00 and followed by QTYPE
which is 0x0001 for a host address, and QCLASS
which is 0x0001 for Internet.
Host discovery
Query
Typing in a terminal:
ping fpga1.diploma.local
causes the computer to send the following mDNS query:
01 00 5e 00 00 fb 00 23 32 b1 21 52 08 00 45 00 00 41 e6 9d 00 00 ff 11 00 00 99 6d 05 a0 e0 00 00 fb 14 e9 14 e9 00 2d 80 47 00 00 00 00 00 01 00 00 00 00 00 00 05 66 70 67 61 31 07 64 69 70 6c 6f 6d 61 05 6c 6f 63 61 6c 00 00 01 00 01
This frame contains Ethernet header:
01 00 5e 00 00 fb 00 23 32 b1 21 52 08 00
IP header:
45 00 00 41 e6 9d 00 00 ff 11 00 00 99 6d 05 a0 e0 00 00 fb
UDP header:
14 e9 14 e9 00 2d 80 47
and mDNS payload:
00 00 00 00 00 01 00 00 00 00 00 00 05 66 70 67 61 31 07 64 69 70 6c 6f 6d 61 05 6c 6f 63 61 6c 00 00 01 00 01
The payload says:
- Transaction Id:
0000
- Flags:
0000
(standard query) - Questions:
0001
- Answer RRs:
0000
- Authority RRs:
0000
- Additional RRs:
0000
- Query:
-
05
bytesfpga1
-
07
bytesdiploma
-
05
byteslocal
-
- QTYPE:
0001
(host address) - QCLASS:
0000
Answer
To this, the selected device should respond: