Using avahi-browse to Discover mDNS Services in Linux

The avahi-browse command is a network discovery utility in Linux used to scan, identify, and display Multicast DNS (mDNS) and DNS Service Discovery (DNS-SD) services running on a local network. Operating as part of the Avahi Zeroconf suite, it enables administrators and users to detect network-accessible resources—such as network printers, SSH servers, file shares, and media streaming devices—without relying on a centralized unicast DNS server. This article details the core function of avahi-browse, its primary options, and how it is used to inspect local network services.

Core Function of avahi-browse

In a Zero-configuration networking (Zeroconf) environment, devices broadcast their presence and service availability over UDP port 5353 using mDNS. The avahi-browse command queries the local avahi-daemon to listen for these broadcasts or actively solicit responses from nearby hosts.

Its primary functions include:

• Service Enumeration: Identifying which service types (such as _http._tcp, _ssh._tcp, or _ipp._tcp) are available on the subnet.
• Host Resolution: Mapping mDNS service names to specific hostnames, IP addresses, and listening port numbers.
• Metadata Extraction: Reading TXT records associated with services, which often contain configuration details like printer models, paths, or device states.

Common Syntax and Essential Options

By default, running avahi-browse requires specifying a service type. However, several flags expand its functionality for general exploration and troubleshooting.

Scanning All Services (-a or --all)

To scan for all available service types rather than just a specific one, use the -a flag:

avahi-browse -a

Resolving Service Details (-r or --resolve)

By default, avahi-browse only lists the service name, type, and domain. Adding -r instructs the tool to resolve the service, displaying the exact hostname, IP address, port, and TXT record metadata:

avahi-browse -a -r

Terminating After Scanning (-t or --terminate)

avahi-browse typically runs continuously, listening for new services or announcements until interrupted. The -t flag instructs the command to exit automatically once it finishes dumping the initial cache:

avahi-browse -a -r -t

Ignoring Local Services (-c or --ignore-local)

To isolate and view only external devices on the local subnet while ignoring services hosted on the machine executing the command, use -c:

avahi-browse -a -c

Filtering Specific Service Types

Instead of scanning all services, avahi-browse can target a particular protocol. Common examples include:

• SSH Servers: avahi-browse _ssh._tcp -r
• HTTP Web Servers: avahi-browse _http._tcp -r
• Printers (IPP): avahi-browse _ipp._tcp -r
• Workstations: avahi-browse _workstation._tcp -r

Practical Value

The avahi-browse command is essential for troubleshooting connectivity in environments that rely on dynamic addressing. When a network printer, IoT device, or development server is unreachable via standard hostname lookups, running avahi-browse allows network operators to verify whether the host is successfully announcing its mDNS presence, what IP address it is using, and whether the targeted service port is exposed correctly.