Repository: avahi/avahi

Issue #379: Wireshark reporting reflected mDNS responses as being malformed
Created: 2022-06-04T18:47:19Z
I'm trying to separate some IOT devices onto a VLAN.  I've setup avahi-daemon to reflect MDNS traffic between my main LAN and the new VLAN.   I have a terrible issue with resolving mDNS domain names with this setup, and using wireshark to inspect mdns traffic reveals the following:
Original packet:
0000   01 00 5e 00 00 fb 48 e1 e9 32 ca c7 08 00 45 00   ..^...H..2....E.
0010   00 f9 e5 10 00 00 ff 11 e6 fe c0 a8 4d 40 e0 00      ............M@..
0020   00 fb 14 e9 14 e9 00 e5 2e 4b 00 00 84 00 00 00   .........K......
0030   00 01 00 00 00 05 04 5f 68 61 70 04 5f 74 63 70   ......._hap._tcp
0040   05 6c 6f 63 61 6c 00 00 0c 00 01 00 00 11 94 00   .local..........
0050   0e 0b 4d 53 47 31 30 30 2d 63 61 63 37 c0 0c c0   ..MSG100-cac7...
0060   27 00 10 80 01 00 00 11 94 00 4b 04 63 23 3d 32   '.........K.c#=2
0070   04 66 66 3d 32 14 69 64 3d 46 33 3a 42 45 3a 36   .ff=2.id=F3:BE:6
0080   37 3a 41 42 3a 31 30 3a 45 39 09 6d 64 3d 4d 53   7:AB:10:E9.md=MS
0090   47 31 30 30 06 70 76 3d 31 2e 31 04 73 23 3d 31   G100.pv=1.1.s#=1
00a0   04 73 66 3d 30 04 63 69 3d 34 0b 73 68 3d 52 64   .sf=0.ci=4.sh=Rd
00b0   6f 62 75 51 3d 3d c0 27 00 21 80 01 00 00 00 78   obuQ==.'.!.....x
00c0   00 0f 00 00 00 00 13 92 06 6d 74 37 36 38 37 c0   .........mt7687.
00d0   16 c0 9e 00 01 80 01 00 00 00 78 00 04 c0 a8 4d   ..........x....M
00e0   40 c0 27 00 2f 80 01 00 00 11 94 00 09 c0 27 00   @.'./.........'.
00f0   05 00 00 80 00 40 c0 9e 00 2f 80 01 00 00 00 78   .....@.../.....x
0100   00 05 c0 9e 00 01 40                              ......@

Reflected packet
0000   01 00 5e 00 00 fb 20 6d 31 21 0f d5 08 00 45 00   ..^... m1!....E.
0010   00 f9 00 d1 40 00 ff 11 7c 7d c0 a8 5c 01 e0 00   ....@...|}..\...
0020   00 fb 14 e9 14 e9 00 e5 21 62 00 00 84 00 00 00   ........!b......
0030   00 06 00 00 00 00 04 5f 68 61 70 04 5f 74 63 70   ......._hap._tcp
0040   05 6c 6f 63 61 6c 00 00 0c 00 01 00 00 11 94 00   .local..........
0050   0e 0b 4d 53 47 31 30 30 2d 63 61 63 37 c0 0c 06   ..MSG100-cac7...
0060   6d 74 37 36 38 37 c0 16 00 2f 80 01 00 00 00 78   mt7687.../.....x
0070   00 05 c0 9e 00 01 40 c0 27 00 2f 80 01 00 00 11   ......@.'./.....
0080   94 00 09 c0 27 00 05 00 00 80 00 40 c0 35 00 01   ....'......@.5..
0090   80 01 00 00 00 78 00 04 c0 a8 4d 40 c0 27 00 21   .....x....M@.'.!
00a0   80 01 00 00 00 78 00 08 00 00 00 00 13 92 c0 35   .....x.........5
00b0   c0 27 00 10 80 01 00 00 11 94 00 4b 04 63 23 3d   .'.........K.c#=
00c0   32 04 66 66 3d 32 14 69 64 3d 46 33 3a 42 45 3a   2.ff=2.id=F3:BE:
00d0   36 37 3a 41 42 3a 31 30 3a 45 39 09 6d 64 3d 4d   67:AB:10:E9.md=M
00e0   53 47 31 30 30 06 70 76 3d 31 2e 31 04 73 23 3d   SG100.pv=1.1.s#=
00f0   31 04 73 66 3d 30 04 63 69 3d 34 0b 73 68 3d 52   1.sf=0.ci=4.sh=R
0100   64 6f 62 75 51 3d 3d                              dobuQ==

Duplicate issue #389: mdns hostnames (other devices on the network) incrementing at vastly faster rate since installing avahi (and scrypted).
Created: 2022-07-28T06:25:11Z
Issue: Hostnames (of other devices on the network) are incrementing (to combat perceived conflicts), but incremeting substantially faster than they used to.  Breaks some browsing and home automation that I would like to do.  Many devices on the network, but 2 iPhones and an appletv consistently increment their hostnamesmuch more often than the rest of the Bonjour devices. Example: my HomePod mini is on like name-3.local, but my iPhone is on name-659.local and I had reset it.  It has climbed much higher.  Restarting my router helps.   Renaming hostnames on iPhone helps. But always temporary.
Unfortunately, I lost my history that had my latest set of logs and troubleshooting, but I was able to save my ssh session, which captures my avahi conf, the contents of avahi-browse, iOS log regarding networking (mdns debugging profile enabled- the rest of the logs stripped out because it's a personal device) and output of syslog and dmesg from device avahi is installed on.
Logs are just under 50 mb and I can't upload them.  Do you have a server or share I can drop them to?
If you can tell me the exact logs you need, I will reproduce all of it and generate appropriate logs from the same time (right now I'm just hobbling to get you some data).
Hardware:
Qotom box running untangle firewall
3x tplink eas 245v3 Wi-Fi access points
3x tplink smart switches
2x vlans, 1x management
Avahi and scrypted running on a Linux Mint mini pc.
172.25.10.1 is router
172.25.10.132 is avahi host
When trying to test IoT network, I put my iphone on 172.25.69.0/24 subnet, and my testing is printing to my brother laser printer.  I consider it a success when I can print to my laser printer from the 69 subnet (it's on 172.25.10.0/24)
joshua_iphone, katie_iphone are the biggest offenders for the hostname increments.
Some devices increment hostname a lot. Others not a much, but ideally, I'd love for it to stay with its original hostname.
Rebooting router temporarily fixes.
Renaming hostname from impacted device temporarily fixes.
Do not have any devices that share the same hostname that conflict with each other.
Firewall logs don't show much, but do show the traffic on 5353
Wireshark does show malformatted packets with some mdns traffic.  Tons of packets, more than I would expect.
Let me know a specific test and what logs you'd like and I will send them your way.
I suspect devices going to sleep and waking up with a stale avahi cache entry can trigger renames.
I suspect the malformed packets could trigger renames.
Have always had this happen when I implemented vlans, but substantially much slower.   Where it might be my iphone-4.local and not iphone-1729.local
Going through the iPhone logs after installing the mdns logging profile from apple. I do see when the hostname changes, but so far no clues as to why.

Closing comment (2023-10-31T11:50:48Z): Closing because of lack of response. If it's still reproducible with the avahi reflector >= 0.8 with #263 included please open a new issue and attach configs/logs/pcaps.

Wireshark does show malformatted packets with some mdns traffic

Malformed packets are tracked in #379