mDNSShark vs DNS Armor™

mDNSShark is an open-source network scanner for iPhone, built for privacy-minded engineers and anyone curious about what is on their Wi-Fi. It listens to Multicast DNS (mDNS), DNS-SD (Bonjour) and SSDP/UPnP to find printers, cameras, media servers, smart home gear and other services on your local network, with no setup and no account. FOR CURIOUS MINDS Ever wondered what your TV, thermostat or camera is saying on your network? mDNSShark shows you: what a device announces about itself, which ports answer, and what your phone talks to. Built by engineers for the curious minded and explorers, with literal values and nothing hidden. WHAT YOU GET - Device discovery: Bonjour/mDNS, SSDP/UPnP, an ARP table read and a light sweep of your own subnet, with MAC vendor lookup. A long list of Bonjour service types is browsed, including cameras, Matter, Thread, appliances and 3D printers. - See what a device says about itself: TXT records are listed exactly as received, and vendors come from the device's own claim or its MAC. - Topology: a map of how devices connect, centered on your gateway, with devices on other networks shown apart. A Networks sheet lists this phone's networks, gateways and off-network devices. - Security assessment: flags risky exposed services such as Telnet, FTP, SMB and RTSP, and checks device manufacturers against CISA's Known Exploited Vulnerabilities catalog and the NVD. Only ports confirmed by a real connection are listed as open. - Probe this device: on request, and behind a confirmation, send the standard probes to a single address on another network. Devices that were never probed say Not probed. - Home Screen and Lock Screen widgets: Devices Online, Scan Now and Security at a Glance. On iOS 26 and later, Scan Now starts a scan right from the widget. - Packet capture: see which servers your phone talks to (DNS lookups, IP addresses, ports), capture mDNS traffic, and export to pcap for Wireshark. - TLS Inspection (optional subscription): decrypt and read your own device's HTTPS traffic using a certificate you install and trust, with a bypass list for apps you want left alone. PRIVACY Scans and analysis run on your phone. Your device list and scan results are never uploaded; only vendor names are sent to the NVD when you tap Refresh CISA Data. Widgets read a snapshot stored on your device. There is no telemetry, no analytics, and no trackers. Two things leave your device, and both are visible to you: while Packet Capture is on, DNS lookups go to the resolver you choose (Google Public DNS by default), and the Refresh CISA Data button you tap yourself downloads CISA's public catalog and asks the NVD about device vendors seen on your network. Discovery needs only local network access; Packet Capture also asks you to allow a VPN configuration. SUPPORT ACTIVE DEVELOPMENT The optional TLS Inspection subscription helps fund active development of mDNSShark: new features, fixes and upkeep. SUBSCRIPTION TLS Inspection Monthly is an auto-renewing monthly subscription. The price and any free trial are shown in the app before you subscribe. Payment is charged to your Apple Account at confirmation of purchase, or when a free trial ends. The subscription renews automatically unless you cancel at least 24 hours before the end of the current period. Manage or cancel any time in Settings > Apple Account > Subscriptions. Discovery, scans, and the Security tab are free. OPEN SOURCE AND YOUR VOICE mDNSShark is built in the open and your ideas shape it. Found a bug or want a feature? Open an issue and tell us. Contributions are welcome too. Bugs and feature requests: https://github.com/Shapehaven-Innovations/mDNSShark/issues Source code: https://github.com/Shapehaven-Innovations/mDNSShark Terms of Use (EULA): https://www.apple.com/legal/internet-services/itunes/dev/stdeula/ Privacy Policy: https://shapehaveninnovations.com/privacy.html

DNS Armor™ for iOS is the iPhone and iPad agent for the Secure Domains DNS Firewall — an enterprise DNS protection service that blocks phishing, malware, command-and-control callbacks, and policy-violating domains at the resolver layer. IMPORTANT — HOW DNS ARMOR WORKS ON iOS DNS Armor™ uses Apple's Network Extension framework (Packet Tunnel Provider, NEPacketTunnelProvider) to install a local on-device VPN. This on-device VPN is the only way Apple permits third-party iOS apps to apply DNS protection system-wide. The VPN exists for one purpose: to intercept DNS queries from every app on your device so they can be securely resolved through your organization's DNS firewall. To be explicit about what this VPN does and does not do: • It intercepts DNS traffic only. Every DNS query from every app — Safari, Mail, Messages, third-party apps, background services — is captured and forwarded to your organization's Secure Domains cloud resolver over an encrypted DNS-over-QUIC (DoQ, RFC 9250) channel with certificate pinning. • It does NOT proxy your web traffic. HTTPS, video, FaceTime, downloads, and every other non-DNS data flow goes directly from your device to its destination, unmodified and never read by DNS Armor™. • It does NOT inspect SSL/TLS, decrypt content, or log browsing activity. • It does NOT route traffic through any external VPN server. The "VPN" is purely an on-device mechanism iOS requires for DNS interception — there is no remote tunnel, no IP-address change, no anonymization. iOS will display the standard one-time system prompt asking you to allow the VPN configuration. This is required for DNS Armor™ to function. The DNS Armor™ agent integrates with Connect-On-Demand for auto-start after reboot, Per-App VPN for BYOD, and Apple's Managed App Configuration channel for MDM-driven zero-touch enrollment. WHAT YOU GET • System-wide DNS protection via on-device Network Extension VPN • Encrypted DNS-over-QUIC with certificate pinning • Cloud-managed policy — your admin controls the blocklist • Per-domain bypass for internal/corporate names that need private DNS resolvers • Auto-start at boot via Connect-On-Demand • Real-time block-page redirection so users see why a site was blocked • Operational status reporting back to your admin console • Full MDM Managed App Configuration support — Jamf, Intune, Workspace ONE, Kandji, Mosyle • Per-app VPN profile compatible for BYOD scenarios • Native IPv4 and IPv6 support end-to-end FOR WHO DNS Armor™ for iOS is built for organizations enrolled in the Secure Domains DNS Firewall. An API code issued by your IT administrator is required to onboard. Without one the app cannot connect — it is not a consumer DNS app. GETTING STARTED Your admin provides an API code. Paste it on first launch, tap Enable Protection, and accept the iOS VPN configuration prompt. From then on, DNS Armor™ stays connected silently and reconnects automatically after reboot. For MDM-managed devices, the API code, hostname, and protection toggle can be pre-populated via Managed App Configuration — first launch completes with no end-user interaction. PRIVACY DNS Armor™ does not log your browsing activity to any third party. Encrypted queries go only to your organization's Secure Domains tenant — never to advertising networks or consumer DNS providers. Non-DNS traffic is not inspected or routed through the agent. The app reports only the minimum operational telemetry needed for enrollment and admin visibility (synthesized device ID, public/private IP, current connection state). See secure-domains.org/privacy. REQUIREMENTS • iOS or iPadOS 16.0 or later • An active Secure Domains DNS Firewall tenant • An API code issued by your administrator DNS Armor™ is a trademark of Secure Domains.