How to tell OS X’s implementation of Bonjour/ZeroConf which network to use for mdns

1. Yes. Stuart Cheshire, who was the creator and is a primary maintainer of Rendezvous/Bonjour at Apple, who also co-chaired the IETF ZeroConf working group, and wrote the O’Reilly book on Zero Configuration Networking, has described Bonjour as a “three-legged stool” where the legs are:

   1. IPv4 (and IPv6) link-local addressing
   2. Multicast Name Resolution (mDNS)
   3. DNS Service Discovery (DNS-SD)

   The IETF ZeroConf working group and Apple both consider link-local addressing, especially IPv4 link-local addressing (169.254.0.0/16 addresses) to be part of ZeroConf/Bonjour, even though link-local addressing shipped years before the other two “legs of the stool”.

   Note that since Windows already supports automatic link-local addressing even without Apple’s Bonjour for Windows software installed, many Windows users do not think of IPv4 link-local addressing to be part of Bonjour/ZeroConf.

2. Yes. Macs and Windows machines, by default, do IPv4 link-local addressing if they are configured for DHCP but there is no DHCP server available. Linux and BSD machines with Avahi (or possibly other ZeroConf implementations) installed will also do this.

3. If a computer is running Bonjour, its hostname is published on the LAN via mDNS. If your machine’s name is “Alice”, it will be Alice.local via mDNS. From another computer (let’s call it “Bob”) on the same LAN (specifically, on the same link-local multicast domain), you should be able to simply type ping Alice.local, and Bob should do an mDNS lookup of Alice.local to discover Alice's IP address(es), and ping (one of) the address(es) it gets back.

   Note, though, that Bonjour differentiates between hostnames and service names. For example, if you have two separate USB printers, let’s say “HP” and “Canon”, connected to Alice, and Alice is acting as, say, an lpr print server for both of them, they can each show up as their own service, which maps back to Alice.local as the host.

   Their service names would show up to the user as “HP” and “Canon” with no mention of Alice. Behind the scenes, they would be known as HP._printer._tcp.local and Canon._printer._tcp.local, and DNS-SD lookups on those service names would show that those services are available on Alice.local on two different TCP ports.

   So yes, applications must notify the Bonjour daemon (called mDNSResponder in Apple’s implementation) that they have services they want to advertise. macOS has mechanisms to automatically handle service advertisement for legacy services that are not natively Bonjour-aware. For instance, macOS's sshd is OpenSSH, which doesn't support Bonjour directly, but macOS takes care of advertising the ssh service via Bonjour so that you can just ssh username@Alice.local from other machines on the LAN.

4. On macOS, there's a "dns-sd" command-line tool that can register a service using this syntax:

   dns-sd -R <Name> <Type> <Domain> <Port> [<TXT>...]  
   # (Register a service)
   

   So for example:

   dns-sd -R MyWebsite _http._tcp local 80
   

   I would not be surprised if it is included in Bonjour for Windows, or the Bonjour SDK for Windows, or if you can compile it for Windows from Apple’s mDNSResponder open-source project. Googling for dns-sd.exe, I see such a thing exists. I am not sure I would just download a binary for it. Instead I would try to get it from one of the packages mentioned above, or compile it myself from the mDNSResponder project sources.

5. You can also use the dns-sd command-line tool to browse for services and look them up. Here is an example of looking up a local web service:

   Browse for local web services with -B:

   $ dns-sd -B _http._tcp local  
   Browsing for _http._tcp.local  
   Timestamp     A/R Flags if Domain                    Service Type              Instance Name  
   16:30:59.870  Add     3  6 local.                    _http._tcp.               My Cool Web App  
   16:30:59.871  Add     3  6 local.                    _http._tcp.               Someone Else's Web Service  
   16:30:59.871  Add     3  6 local.                    _http._tcp.               A Third One  
   ^C
   

   Look up the one I want, "My Cool Web App", with -L:

   $ dns-sd -L "My Cool Web App" _http._tcp local  
   Lookup My Cool Web App._http._tcp.local  
   16:31:52.678  My\032Cool\032Web\032App._http._tcp.local. can be reached at MyWebServer.local.:80 (interface 6)  
   ^C  
   

   Query the IP addresses for MyWebServer.local, with -Q:

   $ dns-sd -Q MyWebServer.local  
   Timestamp     A/R Flags if Name                             T   C Rdata  
   16:32:40.786  Add     2  6 MyWebServer.local.               1   1 169.254.45.209  
   ^C  
   

   Note in these examples that you must Ctrl-C out of the dns-sd tool. Otherwise it will stay open forever, continuously watching the network and reporting any changes in the results of the query you issued (such as web servers coming and going on the network, while you sit with a -B browse query open). I have found that for this and other reasons, the dns-sd tool is not well suited for being called from a script. You might want to look at what the ZeroConf libraries for your preferred language after all.

To answer one of your other questions, I am not aware of any ZeroConf implementation that allows you to perform queries and get results just by reading/writing files. Most apps that use Bonjour do so by calling the APIs, either directly (C/C++/Obj-C/Swift apps) or through a library specific to the language (interpreted/scripting languages).

With any *nix application, the easiest method is to query the binary itself. In the case of httpd, I'd imagine the process would be something like this:

$ whereis httpd
/usr/sbin/httpd
$ /usr/sbin/httpd -V
Server version: Apache/2.2.11 (Unix)
Server built:   Jun 17 2009 14:55:13
Server's Module Magic Number: 20051115:21
Server loaded:  APR 1.2.7, APR-Util 1.2.7
Compiled using: APR 1.2.7, APR-Util 1.2.7
Architecture:   64-bit
Server MPM:     Prefork
  threaded:     no
    forked:     yes (variable process count)
Server compiled with....
 -D APACHE_MPM_DIR="server/mpm/prefork"
 -D APR_HAS_SENDFILE
 -D APR_HAS_MMAP
 -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
 -D APR_USE_FLOCK_SERIALIZE
 -D APR_USE_PTHREAD_SERIALIZE
 -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
 -D APR_HAS_OTHER_CHILD
 -D AP_HAVE_RELIABLE_PIPED_LOGS
 -D DYNAMIC_MODULE_LIMIT=128
 -D HTTPD_ROOT="/usr"
 -D SUEXEC_BIN="/usr/bin/suexec"
 -D DEFAULT_PIDLOG="/private/var/run/httpd.pid"
 -D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
 -D DEFAULT_LOCKFILE="/private/var/run/accept.lock"
 -D DEFAULT_ERRORLOG="logs/error_log"
 -D AP_TYPES_CONFIG_FILE="/private/etc/apache2/mime.types"
 -D SERVER_CONFIG_FILE="/private/etc/apache2/httpd.conf"

As you can see - my OS X says the binary, if not directed otherwise, will use the config file: /private/etc/apache2/httpd.conf

If that doesn't help, perhaps Christopher's suggestion of find is the next step.