mDNSResponder issue

Question

Level 1

16 points

mDNSResponder issue

Hi

Shortly after buying this new iMac, the activity light on the broadband modem flashed constantly, even when there should have been none... Little snitch showed near constant activity for mDNSResponder at the address used for my Modem/ISP... I tried calling apple for support, they ultimately told me my broadband was too slow... well it's the same provider for like... 10 years... and they had no other ideas, none.... (grumble)... This problem ***** a lot of bandwidth and makes the internet almost unusable. And my MBP on the same wireless network while a user is logged on to the iMac... forget about it...

OK... I finally found some information (on my own, thanx Apple!!) and I got some ideas... Long story short... I call up the terminal utility and unload the mDNSResponder plist... which of course disables the internet... then, I load the mDNSResponder plist... and PROBLEM SOLVED... Activity light stops unless it's supposed to be flashing.... and the system stays stable as long as the user stays logged in...

Problem is, I've got a family of users that have their own accounts and are not interested in, or particularly capable of, operating at the terminal level... because of course, unload and load has to occur every time one logs out or logs in....

I tried some plist changes using wrangler... stuff like adding a key line ... MoMulticastAdvertising, or StrictUnicastOrdering.... Nope... no effect...

I also saw that some DNS addresses return an error message to this whole Bonjour thing and this causes the mDNSResponder to keep cycling... so I changed the DNS to OpenDNS and then the Google DNS... no effect... same behavior... The only thing that works, no matter the DNS, is to unload and then load the mDNSResponder plist at the terminal... And if it were just me using the machine, I'd learn to live with it...

BUT WHY SHOULD ANYONE HAVE TO?????.... for God's sake... I'm not the only one with the problem... My MBP works fine, but it uses OS X 10.5.something.... I don't think I'll upgrade anytime soon...

Is applescript hard and can I had a script at start up... or better yet... Is there a fix?????

Thanx

Mark

3.06 GHz Intel Core 2 Duo, Mac OS X (10.6.4), MBP, iPhone 3Gs

Posted on Jul 24, 2010 8:45 PM

Reply

Answer 1

igirl1

Level 1

120 points

Aug 6, 2010 7:37 AM in response to Roger Wilmut1

Roger Wilmut1 wrote:
Please see this Apple Tech Note:

http://support.apple.com/kb/HT3789

Thank you, however this isn't answering the question...

I'm well aware that mDNSResponder is Bonjour.
Disabling DNS is not an option as it kills internet connectivity.
Other Macs on the same network do not have this problem...only one from which new router software was installed (in my instance, not others)

REBOOTING - the issue just starts back up - CONSTANT outgoing data detected by Little Snitch.
TEMPORARY FIX - the OP mentioned it - but never SAID what to do...so here it is...

*In Terminal - type -*

*sudo killall mDNSResponder*

That finally, stops it. I am doing more detective work on this today and will see what else I can come up with. Going to try - App Zapper - destroy the newly installed softwares and see if that cleans it out. Reinstall Snow Leopard and hope it wipes it out. Boot from a week old system backup (Super Duper or Carbon Copy Cloner...I have one of each)...this would likely work, but then I would have to reinstall the new router software on it as well. Use Time Machine. I've never tried it but had it running on a 1TB for years as a last resort backup, maybe it's actually useful for something like this?

Your input is very much appreciated - still looking for an actual cause, and fix. Thanks!

Reply

Answer 2

etresoft

Level 9

57,630 points

Jul 24, 2010 10:14 PM in response to MacPow75

Do you have any 3rd party software installed on this machine? If so, what?

Are you connected directly to the modem or are you going through a router. You should be using a router. If you are directly connected to the modem, that will put your computer on the Internet where other people can directly connect to it, causing this and other problems.

Reply

Answer 3

MacPow75 Author

Level 1

16 points

Jul 25, 2010 4:27 AM in response to etresoft

Hmm... When I initially looked at this problem, that was the very first thing I considered, some kind of security problem. Especially given that I used windows for a long time and it was the constant fighting with malware/spyware on the PC that made me completely switch to mac at home.

I am on a linksys wireless router using a speedstream modem. A big list of software, are there any particular titles that are known to cause this on mac? Most of the software on the iMac is on the MBP and the MBP behaves well on the same wireless network unless the iMac is on and cycling through the mDNSResponder. Thing is, going this road of looking at other software and the hardware always comes up with no answers.... Additionally, I am not alone with this problem. and I have never read that there is a hardware or other software problem causing it.

And Bonjour, which uses the mDNSResponder, even if Safari is not launched, as I understand it... is all about letting my mac be known about on the network/internet...

Sorry for the tone of my initial post.... I should never post when I've worked on a frustrating problem all day without taking a breather first.

I am fascinated by the fact that unloading the mDNSResponder.... then reloading it, at the terminal ... completely resolves the problem. The problem is gone, for as long as that user is logged in to their account.... I think the answer must partially reside there....

Think about it.... If it was a hardware problem... why would the only solution I've found, which was software, OS X 10.6.4, related, work at all ? ... If it was some 3rd party software, hmm, I can see maybe dropping the internet connection ....(is this mDNSResponder like the old windows sockets that drove me crazy back in the 90's?)... would drop the software's claim/connection???... But others have mDNSResponder issues AND Apple and other sites have info on this, although it is cryptic and I haven't been able to find a solution, yet...

And in the meantime, I'll just have to learn some applescript....

Thanx

Reply

Answer 4

MacPow75 Author

Level 1

16 points

Jul 25, 2010 6:09 AM in response to MacPow75

Actually, there is a chance that some software, not on my MBP, was installed when I hooked up an Epson Artisan 810 printer... I looked at that issue way back and wasn't able to come up with anything. But it may be using Bonjour... IDK

Reply

Answer 5

etresoft

Level 9

57,630 points

Jul 25, 2010 7:14 AM in response to MacPow75

MacPowell wrote:
Hmm... When I initially looked at this problem, that was the very first thing I considered, some kind of security problem.

It is not really a security "problem". Even if you were broadcasting yourself to the world, you are still on a Mac, so you'll be fine. Still, it can be disconcerting when looking at log log files and see people actively trying to hack into your MacBook.

I am on a linksys wireless router using a speedstream modem. A big list of software, are there any particular titles that are known to cause this on mac? .... Additionally, I am not alone with this problem. and I have never read that there is a hardware or other software problem causing it.

Not really. It isn't necessarily a problem either. It is probably just a difference in configuration. I would start by looking at the Security and Firewall settings on both of your computers and looking for differences. The offending software could easily be something from Apple, such as MobileMe, that is specifically designed to make some of your computer's services available on the internet.

And Bonjour, which uses the mDNSResponder, even if Safari is not launched, as I understand it... is all about letting my mac be known about on the network/internet...

Actually, Bonjour is mDNSResponder.

Sorry for the tone of my initial post.... I should never post when I've worked on a frustrating problem all day without taking a breather first.

Don't worry about that. It isn't unusual. Many people only find out about this site and post here after getting very frustrated. Unfortunately, not all problems have a quick and easy solution. Some, such as yours, may require some research on your part. But it is also possible that someone who knows this particular software very well or has already resolved this problem may have a possible solution to contribute.

I am fascinated by the fact that unloading the mDNSResponder.... then reloading it, at the terminal ... completely resolves the problem. The problem is gone, for as long as that user is logged in to their account.... I think the answer must partially reside there....

Yes. Look at the Login Items under the user accounts. (System Preferences > Accounts) If there are any, you can try to disable them, log out and back in, and see if the problem recurs. If not, re-enable the items one by one and repeat until you find the offending item.

Think about it.... If it was a hardware problem... why would the only solution I've found, which was software, OS X 10.6.4, related, work at all ? ...

I doubt it is a hardware problem. It is probably some software, probably Apple software, working as designed. It is not, however, working the way you want. If you can find what service is causing it, you should be able to turn it off.

If it was some 3rd party software, hmm, I can see maybe dropping the internet connection ....(is this mDNSResponder like the old windows sockets that drove me crazy back in the 90's?)... would drop the software's claim/connection???... But others have mDNSResponder issues AND Apple and other sites have info on this, although it is cryptic and I haven't been able to find a solution, yet...

Try running console, show log list (in the upper left corner), select "All messages" and search for "dns". That could shed some light on the problem.

Reply

Answer 6

igirl1

Level 1

120 points

Aug 5, 2010 5:26 PM in response to MacPow75

You're not alone - I'm having the exact same issue... It wasn't happening a wek ago and started when I first installed a NetGear Router (that didn't work out) and now a Linksys - also having the same constant outgoing activity in Little Snitch showing up.

The thing is - the outgoing appears to be headed to my ISP. I have no idea how to stop it - maybe block it in LS?

Reply

Answer 7

igirl1

Level 1

120 points

Aug 5, 2010 6:02 PM in response to igirl1

Changing DNS to Google 8.8.8.8 and 8.8.4.4 makes no difference - it just starts sending (whatever it's sending out) to them.

Of course if you block it in LIttle Snitch - your internet dies as that's where it wants to go to look things up. I switched USER accounts and the same thing is happening. Restarted everything - modem - router - Mac - all the same.

I have a new MacBook on the same network and it's not having the issues as the desktop - MacMini.

Must have to do with something the installers for the routers did to the Network prefs...but what?
Trash the Network prefs or reinstall the OS? 😟

Reply

Answer 8

Aug 5, 2010 10:48 PM in response to igirl1

I just received a new 27" iMac a few days ago and I noticed this immediately. We have a couple of MacBook Pros running 10.6.4 with Little Snitch and they are not doing this... I worked on seeing if I could fix this problem for the entire day before stumbling on this post. I did install some Epson software but was just expecting the ArcSoft Connect Service crap...

I have thousands of packets flying to port 53 of my primary name server like a constant ping... what is going on here???

Reply

Answer 9

Aug 6, 2010 8:01 AM in response to igirl1

The Tech Note I linked to tells you how to stop it without disabling your internet connection:

"You can use this advanced article if you are a network administrator who needs to disable Bonjour advertising service without disabling Bonjour queries and DNS."

Reply

Answer 10

Aug 6, 2010 9:37 AM in response to MacPow75

I think I might found what was causing this behavior...

Since I have a new system, and I feel that re-installing the OS is the last, end-of-the-line, least desirable thing to even do, I started backing off applications that I installed to see if I could eliminate this behavior..

Being a bit worried about the crap that got put on the system when I installed MS Office 2008 and the network apps that come with the drivers for my Epson Atrisan 810, I started removing them. I uninstalled Office and rebooted... no effect. Same problem. I then removed every bit of the Epson 810 printer/scanner code and rebooted... guess what? It mDNSResponder was not continuously talking any more... Hmmmm

So, I put Office back on... still good. Then I put back on the Epson Software (without adding a printer yet)... still good!... hmmm.... I then went to add my actual printer back in using the "Print & Fax" panel. I noticed that when I selected "+" to "Add Printer", I immediately had a choice for "EPSON810:Bonjour". My first inclination would be to just click on this and be on my way; however, I paused to think about it for a moment and all of a sudden another entry popped up "EPSON810 (IP)". wow... So, I selected the "IP" printer and went through the rest of the configuration and rebooted. Still good! I tested out the printer and everything (including the Event Manager and scanner) worked as advertised. I rebooted again and as of this writing, mDNSReponder is behaving itself. Let's hope it stay that way.

...and I thought that the only issue with the Epson software was going to be the lame ArcSoft ConnectionServer process... thanks again Epson...

Reply

Answer 11

igirl1

Level 1

120 points

Aug 6, 2010 10:10 AM in response to netispguy

I then removed every bit of the Epson 810 printer/scanner code and rebooted... guess what? It mDNSResponder was not continuously talking any more... Hmmmm

I wonder if this is coincidence - or not - I've been attributing this to installing a new router - but a few weeks ago I bought a new scanner - Epson V30 - and installed all associated software (Including ArcSoft).

Going to run the Uninstaller and/or App Zapper and see if that's the cure.

Reply

Answer 12

igirl1

Level 1

120 points

Aug 6, 2010 10:53 AM in response to netispguy

netispguy wrote:
I hate to say it, but turning off advertising does NOT fix the problem... I added the code to the plist as instructed by the Tech Note and mDNSResponder is still a problem...

calling Apple...

Glad you were able to execute that and find out. I tried and failed resulting in a non-bootable Mac - easily restored by pasting the original plist back in over the (incorrectly) modified one.

I had a LOT of hope for uninstalling the Epson software - and it did work for me initially - until I rebooted. 😟

If one could write a startup routine to use terminal for - sudo killall mDNSResponder
That would be a work around...possibly done in Automator, but I'm not that clever. Still, it would not be a FIX.

Reinstalling Snow Leopard maybe? That's next - after another backup today. I would be very interested to hear what Apple says, although it takes a lot of time and tolerance of script reading drones to get through to the 3rd tier, actual support guys in the US.

Reply

Answer 13

Aug 6, 2010 12:16 PM in response to igirl1

igirl1... check to see if you have the Epson Event Manager installed... if so, turn off "Enable Network Scan" and see if the fixes it.

I noticed that the name of my machine (ScottsiMac) was truncated to be "ScottsiMac.loca" (truncated)... instead of "ScottsiMac.local"... could this be the problem.

All i know is that when I unchecked the "Enable Network Scan", mDNSResponder instantly stopped its continuous behavior...

Has anyone seen problems with Computer Name length?

Reply

Answer 14

igirl1

Level 1

120 points

Aug 6, 2010 1:06 PM in response to netispguy

netispguy wrote:
igirl1... check to see if you have the Epson Event Manager installed...

I didn't go any further than this, and thought - Hey - I UNINSTALLED the Epson software????

WRONG

Their "uninstaller" does not clean everything out. Rather than messing around with it - I just deleted Epson Event Manager.app in App Zapper (since their uninstaller wouldn't do it). There is another non-uninstalled App also associated with all of this in a second folder written into the main Applications Folder - also AppZapped. Then I trashed both Epson Folders.

SOLVED! - Or - at least I hope so? Now that I know the problem, I can try to reinstall these and make sure that "Enable Network Scan" is set to OFF. Let's see if it remains silent. Thanks for the nightmare Epson! LOL

Reply

Answer 15

Aug 6, 2010 2:08 PM in response to netispguy

I shut down bonjour following the tech note and it did NOT solve the problem. I don't think that is what is going on... I see tons of packets going to port 53 (DNS)... I think it is more DNS related that specifically bonjour.

Go into the "Event Manager" and select the "Network Scan Setting" button. Inside of that there should be a check box "Enable Network Scan"... UNCHECK THIS BOX, and then click "OK". This should stop it.

Keep in mind that you will not be able to use the "Scan to..." buttons on the printer, but scanning (and printing) from your Mac will work just fine.

I just got off of talking to tier 3 support at Epson. They have a ticket open and are escalating it to Engineering for further actions (or so they say). I did speak with Apple Tier 2 support... They were very nice and tried to be helpful, but that is as far as I got with them.

Reply