iOS Bonjour: didFindService but failed to resolve in public Wi-Fi network

Question

I am able to use NSNetServiceBrowser to find and then resolve a mDNS service in my local wi-fi. But in a public Wi-Fi network, the same code can only find the service and then failed to resolve the service.

Ie the following delegate callback is successful:

- (void)netServiceBrowser:(NSNetServiceBrowser *)aNetServiceBrowser
           didFindService:(NSNetService *)aNetService
               moreComing:(BOOL)moreComing

but the following callback is never called:

- (void)netServiceDidResolveAddress:(NSNetService *)sender

and instead I got the following called:

- (void)netService:(NSNetService *)sender
didNotResolve:(NSDictionary<NSString *,NSNumber *> *)errorDict

and the errorDict was:

{
    NSNetServicesErrorCode = "-72007";  // timeout
    NSNetServicesErrorDomain = 10;
}

To debug, I used WireShark to capture the UDP packets, and found there was a mDNS response packet that has a SRV record that includes the host IP and Port.

My question is: what exactly does iOS Bonjour resolves a service under the hood? Why did it not expose more info when finding the service? (and how is it different in public Wi-Fi network?)

iOS version: 12 and 13

Answer 1

Most public WiFi networks implement client isolation; they allow your devices to talk to the Internet but not another device on the same wifi network.

This is to prevent someone on the network from launching attacks against other devices that may have vulnerabilities that would typically be mitigated by a firewall, but are exposed to devices on the same local area network.

The service can be discovered because the multicast packet is forwarded to all devices (multicast, like broadcast isn't directed at a specific device).

However, the unicast packets required to connect to the service are directed to a specific device and are therefore blocked.

In typical client isolation implementations the network blocks ARP requests, which is why you get the error that the service address could not be resolved. It is as though a device with the required IP address simply doesn't exist on the network.