In the activity monitor I see high sending bytes of the process mDNSresponder, when I search online for screenshots I see that it is mainly receiving bytes but not sending this much. Currently it is sending 38 kb/min which seems high compared to others on the internet. Even in safemode it is sending this much data.
can anyone please help me if this is normale behaviour or if i need to do something?
MacBook Pro (2017 – 2020)
Similar question from Earlier Version of macOS
You may what to refer to responses from Luis Sequeira1 and John Galt
What is mDNSResponder - and why is it run… - Apple Community
Yes I have read that, but in my case I don’t understand why it is sending so many files, is this suspicious behaviour or is it completely normal?
AppleProblem33 wrote:
Yes I have read that, but in my case I don’t understand why it is sending so many files, is this suspicious behaviour or is it completely normal?
That would be difficult to answer accurately without seeing what Applications are installed and used on this computer.
We can guess and surmise but I do not think you what that, do you ?
Download the Application Etrecheck directly from the Developer.
This is a Diagnostic Tool that makes no changes to the computer.
It makes a coherent and readable inventory of both the Hardware and Software used on the computer
The application is free or paid from added features.
The Report will Not Reveal Any Personal Information.
Post back the Full Report - copy and paste - >>>> using the Additional Text Icon ( 3rd Icon to last ) <<<<
In good faith - I have just run the specific application mentioned above - just to Test my machine
Refer to below " My Machine " file
The mDNSResponder process relates to the mDNS (multicast DNS) protocol that is used to discover devices on the local network. Network activity, around this process, is typically ... normal.
mDNS is also referred to as "Zero Configuration Networking" or "Zeroconf."
Where mDNS traffic increases is when there isn't a conventional Unicast DNS server located on the same network as the client. In this case, the client will rely on mDNS to locate other devices (than can respond to mDNS) on that local network.
If you are concerned about the amount of mDNS traffic, you can use a tool, like Wireshark, to perform network data captures to see what devices are "communicating" via mDNS. In addition, you could verify that whatever device (most likely your local network's router) is providing DNS services properly.
Just a quick note on WireShark and only from Observations on these Forums
It may provide the needed info.
Be aware it may load Extensions onto the machine which sometimes do and sometimes do not play well with the Operating System or at least with Normal Internet Connections
I have been hesitant with downloading software from the internet because of malware etc…
The past hour I have stopped the bluetooth connected to my mouse and keyboard and this got the send bytes down significantly (now its nog constantly sending but only when browsing the web). Next to that I have checked a macbook from someone in the same house en that one had high sending of the same process. Does this make the story different?
I don't think the story has changed, related to mDNSResponder.
However, I do appreciate P. Phillips's comments around Wireshark. The app will install an executable, ChmodBPF, as a Launch Daemon. This is how it is able to capture data packets. It is not loaded when the app is inactive, so it doesn't reside in the background. Regardless, interpreting Wireshark captures will require a fairly extensive background in understanding network protocols. If you are already comfortable with this topic, this tool will greatly aide in troubleshooting. Lastly, I do not have this app installed on my "main" computer. Instead, I have a dedicated "older" Mac that I use for network troubleshooting where this tool, and others, call home.
Here I will respectfully defer to my More Learned Colleague @ Tesserax for a much more in-depth explanation 🤞
What I can illustration in image below
Use a M1 Mac Mini with Ventura 13.5 and the Apple Bluetooth Magic Mouse 2 ( rechargeable Battery ) and the Apple Bluetooth Magic Keyboard 2 ( also with rechargeable Battery )
Connected via Wifi on 5 gHz network with a Fibre Optic ( 1.5 GB Speed ) to ISP Router
Sent Bytes 1.6 MB, Received Bytes 3.4MB, Sent Packets 3,347 and Received Packets 14,529
This machine has been in use since 04:00 Hrs EDT to current time 12:18 Hrs EDT = 8 Hours On and Running
Perhaps I mixed the name up " Wireshark " with something similar and if so mea clupa
Background on Etrecheck Application
At one time there was an Etrecheck Application available on the Apple Apps Store.
Due to certain constrains place upon the Developer by APPLE, the developer chose to remove it from the Store and make is available Directly from them.
This specific application is well known, on these Forums, as a Go To for trouble shoot and avoiding all the question / answer and question / answer to finally get the issue pinned down.
It is also known and reported by Reliable Sources that, sometimes APPLE SUPPORT has invoked using this same Developer Distributed Version of Etrecheck application to trouble shot computer issues
If you do a quick search on the Front Page of there Forums using " Etrecheck " you may find about 287 Posting related to the usage of this application
Lastly - should to decide to use and post the Report now or at a later time, we are willing to have a very close look and offer some insights
PS - I am not affiliated with nor do I receive any compensation from the Developer for suggesting using this application - Incase that may also be a concern you have
No problem. I'm still thankful for your comments as I have not only learned from them; I appreciate them.
Let me see if I can add a bit more, without using too much techno-babble.
A popular implementation of mDNS is Apple's Bonjour. This service is primarily to more easily connect network printers to a Mac. It basically allows devices to respond to mDNS queries. Note; however, only devices with hostnames ending with ".local" hostname, would participate.
However, this in not only where mDNS is used. For example, web browsers based on Chromium (that includes Google Chrome, Safari, Microsoft's Edge, Opera, & Brave, etc.) use mDNS to locate printers when you print a web page. AirPlay is also heavily dependent on mDNS.
Finally, guess what else uses mDNS? Yep ... IoT devices do too!
So, you can see, although you can disable mDNS, most modern day devices rely on it.
Thank you too and same back
Only as my point of reference to an earlier concern
mDNSresponder high sending bytes
