mDNS is a magical protocol for local device discovery that seems to only work for me like 60% of the time. When it works, it's great. When it doesn't, I'm completely stuck, and the latter happens far too often.
My project for the X-Ray Jam was to learn about mDNS and build a tool that can expose the state of mDNS on the network, including more detailed information about what devices have been discovered, what messages are being sent, etc. The final result is a tool that uses packet capture to track the state of mDNS and DNS-SD services to see which devices are advertising and requesting specific services.
mDNS turns out to be a very simple protocol overall, with typical DNS questions and answers being sent via multicast; that is, sent to every device in the network rather than routed to a single IP. However, like normal DNS, mDNS is request/response, and doesn't facilitate device discovery. DNS Service Discovery (DNS-SD) is that missing piece, and one I was totally unaware of before the jam.
In the above image, all hosts are shown that have identified themselves via an mDNS message - that is, any device for which we have seen an A or AAAA record. The icons below each host represent the DNS-SD services being "advertised". A line is drawn from a device to a specific service if that device has requested a service offered by another host. For example, my PlayStation 5 advertises Spotify Connect, and the Spotify client on both my phone and my laptop has requested that service. Likewise, an attempt to mirror my phone's screen to other devices via AirPlay has caused both of my laptops to advertise AirPlay audio and video. That said - I think I have a bug where too many lines are drawn.
While the tool is obviously rough, I think it is a great proof of concept for the kind of network tooling I want access to in my own home. I think it's fascinating, and actually somewhat important, to see what devices are actually on your network and how they are interacting.
More details about mDNS, DNS-SD, and Buongiorno can be found in this blog post.
