Standards/Ethernet/Bonjour
|
Bonjour is Apple's protocol for service discovery. It is lightweight and works over UDP. Bonjour implements a Multicast Domain Name System (mDNS) service without requiring a conventional DNS server.
Bonjour comprises:
- host discovery: finding the IP addresses of
.local
devices - service discovery: listing the capabilities of the devices
Bonjour is implemented in Linux systems under the name Avahi. There is also a Windows implementation of Bonjour.
mDNS frames
The mDNS multicast frames are sent to the multicast address 01:00:5E:00:00:FB
/ 224.0.0.251
, from and to port 5353
.
Bonjour frames can be filtered in Wireshark with the help of the expression:
ip.version==4 and udp.port==5353
The frame structure is based on the DNS packet format. It is built out of 2 parts: header and data.
offset (bytes) | 0 | 1 |
---|---|---|
0 | ID = 0x0000 | |
2 | Flags | |
4 | QDCOUNT (questions) | |
6 | ANCOUNT (answers) | |
8 | NSCOUNT (authority) | |
10 | ARCOUNT (additional) | |
12 | Data |
The flags are all 0
except for:
- the first bit, Query/Response (QR), which is
0
for a query and1
for a response - the sixth bit, Authoritative Answer (AR), which is equal to the bit QR
The data is the UTF-8 list of the parts of the name preceded by the length of the item.
In a question, the name is terminated with a 0x00 and followed by QTYPE
which is 0x0001 for a host address, and QCLASS
which is 0x0001 for Internet.
Host discovery
Query
Typing in a terminal:
ping fpga1.diploma.local
causes the computer to send the following mDNS query:
01 00 5e 00 00 fb 00 23 32 b1 21 52 08 00 45 00 00 41 e6 9d 00 00 ff 11 00 00 99 6d 05 a0 e0 00 00 fb 14 e9 14 e9 00 2d 80 47 00 00 00 00 00 01 00 00 00 00 00 00 05 66 70 67 61 31 07 64 69 70 6c 6f 6d 61 05 6c 6f 63 61 6c 00 00 01 00 01
This frame contains the Ethernet header, with multicast destination MAC address 01:00:5E:00:00:FB
:
01 00 5e 00 00 fb 00 23 32 b1 21 52 08 00
IP header, with multicast IP address 224.0.0.251
(E0:00:00:FB
):
45 00 00 41 e6 9d 00 00 ff 11 00 00 99 6d 05 a0 e0 00 00 fb
UDP header:
14 e9 14 e9 00 2d 80 47
and mDNS payload:
00 00 00 00 00 01 00 00 00 00 00 00 05 66 70 67 61 31 07 64 69 70 6c 6f 6d 61 05 6c 6f 63 61 6c 00 00 01 00 01
The payload says:
- Transaction Id:
0000
- Flags:
0000
(standard query) - Questions:
0001
- Answer RRs:
0000
- Authority RRs:
0000
- Additional RRs:
0000
- Query:
-
05
bytesfpga1
-
07
bytesdiploma
-
05
byteslocal
- QTYPE:
0001
(host address) - QCLASS:
0001
(question: false, class: in)
-
Answer
To this, the selected device should respond, note that it's not a respong to the Bonjour Discovery above
01 00 5e 00 00 fb 00 26 2d ab 9f 04 08 00 45 00 00 48 00 00 40 00 ff 11 6a f6 c0 a8 6f 0a e0 00 00 fb 14 e9 14 e9 00 34 10 f4 00 00 84 00 00 00 00 01 00 00 00 00 0a 6c 61 70 74 6f 70 41 63 65 72 05 6c 6f 63 61 6c 00 00 01 80 01 00 00 00 78 00 04 c0 a8 6f 0a
This frame contains Ethernet header:
01 00 5e 00 00 fb 00 26 2d ab 9f 04 08 00
IP header:
45 00 00 48 00 00 40 00 ff 11 6a f6 c0 a8 6f 0a e0 00 00 fb
UDP header:
14 e9 14 e9 00 34 10 f4
and mDNS payload:
00 00 84 00 00 00 00 01 00 00 00 00 0a 6c 61 70 74 6f 70 41 63 65 72 05 6c 6f 63 61 6c 00 00 01 80 01 00 00 00 78 00 04 c0 a8 6f 0a
The payload says:
- Transaction Id:
0000
- Flags:
8400
(Standart query response, no error) - Questions:
0000
- Answer RRs:
0001
- Authority RRs:
0000
- Additional RRs:
0000
- Answer:
-
0a
byteslaptopAcer
-
05
byteslocal
-
00
string delimiter - TYPE:
0001
(type A) - CLASS:
8001
(cache flush: True, class: in) - TTL:
00 00 00 78
(Time to live: 2 minutes) - Data length:
0004
(length: 4) - Addr:
c0 a8 6f 0a
(192.168.111.10)
-