How do you get the "Bonjour Service Name" from a single device?

Question

I have two types of device that I want to machine over Ethernet to a host. I want to know which of those two device types is connected.

Both devices use Avahi/Bonjour and have what they call a "Bonjour Service Name" that contains useful information I can use to differentiate the two device types, but network requirements mean that I can't use a blanket mDNS Browse because it'll go out on the secondary network port of the host (which isn't allowed). This "Bonjour Service Name" is consistently used by the devices as the first part of all services they broadcast (e.g. UsefulDeviceName._http._tcp.local, UsefulDeviceName._ftp._tcp.local, UsefulDeviceName._telnet._tcp.local, etc).

Each device of the two types also has its own unique DNS name, but that is just [GenericPrefix][MacAddress].local, which isn't enough to differentiate them (they're from the same manufacturer and so both device types use the same MAC blocks).

Every tool that I've tried so far does an mDNS broadcast across the network and shows the Bonjour Service name, but doesn't meet "not using all ports" network requirement. Running a DNS query like this returns the normal DNS name, not the Bonjour Service Name.

We will know the IP of the device. Is there a simple Linux command that will ask the device "what is your Bonjour Service Name?"/"what Bonjour Service Names do you have?" that can be relied on to only send the packets over the interface that the devices will be connected to, and not the wider network?

Solution

The answer appears to be "there is no reliable way to do it". Not all devices listen/respond to the dig commands listed in the other answer, and everything else to find mDNS names on the network (like avahi-browse and the badly behaved mdns-scan) requires multicasting/broadcasting and can't be used to probe an individual machine.

Comments

[aliasgar]

There is no direct way to get a Bonjour name from the IP Address. But Bonjour Browser does map the IP Addresses to Bonjour Names. There is way to do the same thing Bonjour Browser does through Terminal also. its dns-sd -B.

[IBBoard]

So a machine knows to respond with its full "Bonjour Service Name" when it receives the mDNS multicast packet, but can't be poked directly to find the same information? I've looked at avahi-browser (which sounds like it should do the same) but my understanding is that it'll multicast over all NICs.

[aliasgar]

Yup, seems like it!

[IBBoard]

Okay, in general there is no "the Bonjour Service Name", but in this instance the devices have a config panel that lists one, and I want to get it (and it is the first part of each domain returned by mdns-scan, but I can't use that, as explained earlier). Which IP should I be using for <em>@ip-address</em>? I've just tried the device's IP but got a connection timeout - a quick nmap shows the port isn't open.

[user1686]

@IBBoard: ip-address would be the device's address... mDNS uses only UDP, and nmap doesn't check that by default. But there's a possibility that the device's mDNS stack might be simply ignoring unicast queries.

[IBBoard]

I realised nmap only did TCP a while after I'd posted. It definitely doesn't seem to respond to unicast, though (Wireshark shows the packet going out but nothing coming back).