Multicast DNS - Packet Structure

Packet Structure

The mDNS Ethernet frame is a multicast UDP packet to:

  • MAC address 01:00:5E:00:00:FB
  • IPv4 address 224.0.0.251 or IPv6 address FF02::FB
  • UDP port 5353

Its structure is based on the DNS packet format. It is built out of 2 parts: header and data.

offset (bytes) 0 1
0 ID = 0x0000
2 Flags
4 QDCOUNT
6 ANCOUNT
8 NSCOUNT
10 ARCOUNT
12
Data

The flags are all 0 except for:

  • the first bit, Query/Response (QR), which is 0 for a query and 1 for a response
  • the sixth bit, Authoritative Answer (AR), which is equal to the bit QR

The data is the UTF-8 list of the parts of the name preceded by the length of the item. In a question, the name is terminated with a 0x00 and followed by QTYPE which is 0x0001 for a host address, and QCLASS which is 0x0001 for Internet.

Read more about this topic:  Multicast DNS

Famous quotes containing the words packet and/or structure:

    “The captain was a duck
    With a packet on his back,
    And when the ship began to move
    The captain said, Quack! Quack!”
    —Mother Goose (fl. 17th–18th century. I saw a ship a-sailing (l. 13–16)

    “If rightly made, a boat would be a sort of amphibious animal, a creature of two elements, related by one half its structure to some swift and shapely fish, and by the other to some strong-winged and graceful bird.”
    —Henry David Thoreau (1817–1862)