One of the first steps a social engineer needs to take before any attack is getting to know every type of detail of the target, be it a company or an individual.
Network mapping is especially important to understand where the data is stored and how - for these reasons, mDNS and DNS-SD/zeroconf are practical and quick ways of obtaining lots of information with no effort or risk.
In many cases, the network structure is not fixed, and many services may come up and down in different places, or may simply follow an (unknown or unpredictable) logic.
This simple tool for linux, written in python, listens on the network for new services, and records every appearance/disappearance as well as all the information it can get with service resolution. The retrieved information is then saved in a database, which can be subsequently queried and analyzed to predict service times and availability.