Ettercap/ettercap — pull request #108 by jacob-baines (2013-03-06 19:36:51+00:00)
Title: mDNS Dissector

### Overview
I wrote a pretty simple mDNS dissector. My implementation pulls out domain names and advertised services. The goal of the dissector is to more fully fill out LAN host profiles. Arguably this could probably be pushed into ec_dns.c, but I didn't want to create any confusion in there. Logically separating mDNS into its own dissector seemed fine.

### mDNS Blurb
Multicast DNS is intended to provide host and service discovery to a network without a traditional unicast DNS server(https://tools.ietf.org/html/rfc6762). As such, mDNS provides a lot of information without any type of scanning. For instance, we can get hostnames, open ports, urls, OS information, and more from mDNS broadcast data.

### Example
The following example is taken from http://wiki.wireshark.org/SampleCaptures#mDNS_.26_Apple_Rendezvous

Here is a screenshot of a single wireshark. For our purposes we are interested in the the type A record and the SRV record.

![mdns_wireshark](https://f.cloud.github.com/assets/787916/229026/8b37f0b8-8692-11e2-933d-7f829cd69ac9.png)

Currently, for the capture the above packet is from, ettecap will produce this profile:
![profile_before](https://f.cloud.github.com/assets/787916/229055/7921d4d8-8693-11e2-9bbc-ce99cce185f3.png)

With this patch ettercap produces the following profile. Note the hostname is now populated and port 8080 is listed as open.
![profile_after](https://f.cloud.github.com/assets/787916/229058/aec33c3a-8693-11e2-95c5-049c1d5734d9.png)

### Implementation
I did one weird thing in this patch. As far as I could tell, ettercap doesn't have any concept of an advertised service. Multiple protocols advertise other services (this, CUPS, SSDP, etc.). As such, I pushed that information into PACKET.DISSECTOR. I don't know if what I did is a long term solution (at the very least it should probably be a list), but I figured it was good enough for discussion or until someone told me I'm doing it wrong.