Multicast DNS - Packet Structure

Packet Structure

The mDNS Ethernet frame is a multicast UDP packet to:

  • MAC address 01:00:5E:00:00:FB
  • IPv4 address 224.0.0.251 or IPv6 address FF02::FB
  • UDP port 5353

Its structure is based on the DNS packet format. It is built out of 2 parts: header and data.

offset (bytes) 0 1
0 ID = 0x0000
2 Flags
4 QDCOUNT
6 ANCOUNT
8 NSCOUNT
10 ARCOUNT
12
Data

The flags are all 0 except for:

  • the first bit, Query/Response (QR), which is 0 for a query and 1 for a response
  • the sixth bit, Authoritative Answer (AR), which is equal to the bit QR

The data is the UTF-8 list of the parts of the name preceded by the length of the item. In a question, the name is terminated with a 0x00 and followed by QTYPE which is 0x0001 for a host address, and QCLASS which is 0x0001 for Internet.

Read more about this topic:  Multicast DNS

Famous quotes containing the words packet and/or structure:

    “The captain was a duck
    With a packet on his back,
    And when the ship began to move
    The captain said, Quack! Quack!”
    —Mother Goose (fl. 17th–18th century. I saw a ship a-sailing (l. 13–16)

    “Agnosticism is a perfectly respectable and tenable philosophical position; it is not dogmatic and makes no pronouncements about the ultimate truths of the universe. It remains open to evidence and persuasion; lacking faith, it nevertheless does not deride faith. Atheism, on the other hand, is as unyielding and dogmatic about religious belief as true believers are about heathens. It tries to use reason to demolish a structure that is not built upon reason.”
    —Sydney J. Harris (1917–1986)