Using NSNetServiceBrowser & NSNetService is fairly well documented by Apple for finding specific services. To find all services (and still use the Cocoa API) you have to do a lot more digging. Finding services across domains (Here is a Wide-Area Bonjour Preference Pane for Tiger clients) is hardly documented at all for the moment.
So here is some documentation Details To discover all service types in all domains use
NSNetServiceBrowser searchForServicesOfType: @"_services._dns-sd._udp." inDomain: @""
(if you want a specific domain then set domain appropriately) In the didFindService callback, only the name, type, and domain will be valid fields in the NSNetService. You then want to transform these three fields into a servicetype and servicedomain for feeding into another NSNetServiceBrowser to find all the actual services. For local services the three fields will be of the form:
NSNetService name = "_workstation" type = "_tcp.local." domain = "."
What we want to use are
NSNetServiceBrowser searchForServicesOfType: @"_workstation._tcp." inDomain: @"local."
For remote services the three fields will be of the form:
NSNetService name = "_ssh" type = "_tcp.dns-sd." domain = "org."
What we then want to use are
NSNetServiceBrowser searchForServicesOfType: @"_ssh._tcp." inDomain: @"dns-sd.org."
Basically a little bit of string manipulation will sort it out.