mdnsresponder causes traffic

Question

Level 1

10 points

mdnsresponder causes traffic

Hello,

I am using a Mac mini with Maverick 24/7 and I am watching that the mdnsresponder is causing much traffic and is receiving over 70.000 packets a day!
What is wrong there?

Thank in advance

Frank

Mac mini

Posted on Nov 30, 2013 4:35 AM

Reply

Answer 1

Linc Davis

Level 10

210,631 points

Dec 2, 2013 12:43 PM in response to franlog

Back up all data.

Launch the Keychain Access application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad. Click Utilities, then Keychain Access in the icon grid.

From the menu bar, select

Keychain Access ▹ Preferences ▹ Certificates

There are three menus in the window. Change the selection in the top two to Off.

Log out, log back in, and test. Repeat for all other user accounts, if any. If there's no improvement, revert the menu selections to Best attempt.

The Off settings are not ideal for your security on the Internet. I suggest that you try changing them after the next OS X update from Apple, in case a bug has been fixed.

Reply

Answer 2

Linc Davis

Level 10

210,631 points

Dec 2, 2013 10:54 AM in response to franlog

Back up all data.

If you have more than one user account, you must be logged in as an administrator to carry out these instructions.

Triple-click anywhere in the line below on this page to select it:

sudo rm -i ~root/Library/Caches/ocspd/Cache.db

Copy the selected text to the Clipboard by pressing the key combination command-C.

Launch the Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.

Paste into the Terminal window by pressing the key combination command-V. I've tested these instructions only with the Safari web browser. If you use another browser, you may have to press the return key after pasting. You'll be prompted for your login password. Nothing will be displayed when you type it. If you don’t have a login password, you’ll need to set one before you can run the command. You may get a one-time warning to be careful. Confirm. You don't need to post the warning.

If you see a message that your username "is not in the sudoers file," then you're not logged in as an administrator. Log in as one and start over.

You may be prompted to remove a file named exactly "Cache.db" (without the quotes.) Press the Y key and then return to confirm. Press the N key and then return if you get any other response, or just close the Terminal window. You can then quit Terminal.

Do not type anything in the Terminal window, apart from your password. Copy and paste only.

Restart the computer.

Credit for this idea to ASC members Drew Reece and Elrainia.

Reply

Answer 3

BDAqua

Level 10

251,847 points

Dec 2, 2013 12:40 PM in response to franlog

Google Chrome is one of the worst offenders in this group as it tries to connect to the Google mothership several times a day.

http://www.tuaw.com/2011/12/09/friday-favorites-using-little-snitch-to-stop-apps -from-phoning/

And as I recall it installs behind the scene things also.

http://www.eros-os.org/pipermail/cap-talk/2012-December/015506.html

Reply

Answer 4

Linc Davis

Level 10

210,631 points

Nov 30, 2013 9:56 AM in response to franlog

That's normal. Fortunately the article linked above is only for Windows, and will not cause you to destroy your operating system, as you would if you actually did remove or disable an essential component.

Reply

Answer 5

franlog Author

Level 1

10 points

Nov 30, 2013 11:55 AM in response to Linc Davis

Viewing the traffic at a the network monitor.

The Apple build in "Activity Monitor" ( I do not know if this is the right word. I am german and using a german iOS ) shows about 70.000 packets, but just about 8MB data for this service. But the complete data traffic is about 1GB and this service is the only one that is permanenlyt accessing the internet. When I switch off the Mac, the traffic is normal. So it is definetely the Mac that is causing the traffic in my private network. And I think it is the mdnsresponder.

Reply

Answer 6

Linc Davis

Level 10

210,631 points

Nov 30, 2013 12:12 PM in response to franlog

You have not described any abnormal behavior of mDNSResponder. If Activity Monitor doesn't reveal what is creating the traffic, then you'll have to use a packet-capture tool such as tcpdump(1) or "CocoaPacketAnalyzer" to investigate further. Alternatively, you could boot in safe mode and see whether there's a difference. If there is, then some third-party software is at fault, and finding it is a process of elimination.

Reply

Answer 7

franlog Author

Level 1

10 points

Dec 1, 2013 4:24 AM in response to Linc Davis

Okay I used the CocoaPacketAnalyzer to monitor the traffic. These two are causing the main traffic and are permanently in the list. 192.168.1.150 is my Mac Mini. Do you know where the Mac is always connecting to? (188.40.105.83 and 173.194.112.34)

Id = 663

Source = 188.40.105.83

Destination = 192.168.1.150

Captured Length = 1514

Packet Length = 1514

Protocol = TCP

Date Received = 2013-12-01 11:26:22 +0000

Time Delta = 167.302393913269

Information = 443 -> 49559 ([ACK], Seq=5782125473, Ack=105555964964556, Win=130)

Id = 1886

Source = 173.194.112.34

Destination = 192.168.1.150

Captured Length = 1484

Packet Length = 1484

Protocol = TCP

Date Received = 2013-12-01 11:31:37 +0000

Time Delta = 482.103019952774

Information = 443 -> 49562 ([ACK], Seq=5763148058, Ack=105556549863310, Win=661)

Reply

Answer 8

franlog Author

Level 1

10 points

Dec 1, 2013 4:32 AM in response to franlog

Okay. I found it out myself:

188.40.105.83 is Easy List, an Ad-Blocker. I am not aware using this. I am looking for ot to delete it.

173.194.112.34 is Google. I am not using an Google Account and I do not know which program is permanently connecting to Google???

Reply

Answer 9

Linc Davis

Level 10

210,631 points

Dec 1, 2013 6:17 AM in response to franlog

I do not know which program is permanently connecting to Google

It's either a Google application checking for updates, or Safari's safe-browsing feature:

Safari ▹ Preferences ▹ Security ▹ Warn when visiting a fraudulent website

Reply

Answer 10

franlog Author

Level 1

10 points

Dec 1, 2013 10:42 PM in response to Linc Davis

Okay, I think I am getting closer

I monitored the traffic this night from 11.00pm to 6.00am. The Mac downloaded about 500MB and is permanently connecting to Apple Server:

Id = 2665

Source = 2.16.216.50

Destination = 192.168.1.150

Captured Length = 1514

Packet Length = 1514

Protocol = TCP

Date Received = 2013-12-01 22:01:19 +0000

Time Delta = 1467.309324979782

Information = HTTP -> 50464 ([ACK], Seq=7590255578, Ack=105556896599534, Win=7776)

The same for 2.16.216.18 , 2.16.217.115 , 2.16.217.121 and ...

Looking at the dock all apps were quit except of finder and CocoaPacketAnalyzer. So no active apps.

But when I look at the menu bar at Apple -> Quit now (right? again I am using german iOS) then I see that pages is still active! And when I remember right now, the big data traffic begun after updating pages, numbers and keynote from 09 to 10. And I have sometimes the problem that pages will not quit correctly with a right click on the icon at the dock. Any known bug at pages 10 or just a buggy installation on my Mac. Delete the apps and install them again. (except of the fact that the 09 Version have much more functions than 10!)

Reply

Answer 11

franlog Author

Level 1

10 points

Dec 2, 2013 12:39 PM in response to Linc Davis

Thank you for this very detailed information, but this did not help. My Mac Mini is still talking the whole time to the Apple Server...

® f «∂ú«¶òø E ‹qÕ@ 7U ´ ¿® ñP¿/ ≠z‹[ ÿÛP ˛X0HTTP/1.1 200 OK

Age: 55250

Date: Sun, 01 Dec 2013 22:41:42 GMT

Connection: Keep-Alive

Via: NS-CACHE-9.3: 241

ETag: "KXJILPKGJLMWWUQVQV"

Content-Type: application/ocsp-response

Content-Length: 3434

Server: BAM

0Ç

f

†Ç

_0Ç

[ + 0 Ç

L0Ç

H0Åñ¢ _"±[„Fv÷Û ¿´“ ùªÉB 20131202051215Z0k0i0A0 + 3Å—Ô€h∞Ö!M.ÔØåJid<*l W Ì¢œ‹|ò° ‡¸æá-,Ú„ T xÕËÂ.o4ãÄ 20131202051215Z† 20131203051215Z0

*ÜHÜ˜

ÅÅzÔ aL´qìøä˜=“†ëìÈ ¶^e ã ´)%Z” úÛ ¸ô]|Ú¢ µGlTä∏1ìÂOœ ¸a/¶–á%S$ aN¯˙d:yg(jıw 5⁄ø{Œe] ﬁ÷‘0CG:¯∑5 ≥«%ﬂ—

≥ ‡ “Œ ØóÄUª‘æñ¿|R”†Ç 0Ç 0Ç I0Ç 1† C√ ”â„’w0

*ÜHÜ˜

0y1-0+ U $Developer ID Certification Authority1&0$ U Apple Certification Authority1 0 U

Apple Inc.1 0 U US0

131114212855Z

131226212855Z0J1&0$ U Developer ID OCSP Responder F1 0 U

Apple Inc.1 0 U US0Åü0

*ÜHÜ˜

Åç0Åâ ÅÅ÷!÷Ö

¨ˇæ[wøójxé ^y û⁄ßG £Åá0ÅÑ0 U _"±[„Fv÷Û ¿´“ ùªÉB 0 U ˇ 00 U # 0 Ä W Ì¢œ‹|ò° ‡¸æá-,Ú„ T0 + 0 0 U ˇ Ä0 U % 0

+ 0

*ÜHÜ˜

Ç „àΩëd ÖÎ<OŒ –ú ˘°0 ≥‚/◊◊u2@—èøﬁﬂv÷ƒ œY ‰◊√‰*ΩY_D±ûö¨ÔüˆnRÿc!_!*¡‚¬ı28ä ùHé;Å´´øxh’ïª$ô†-©üq Y¿oQ˙ √›Æ$˛— @lö9ß˚ôì·Œä≤tB\PpË 2 xÕ Õ’‡Ï˛ÂÑófYô` ılC ~˝ \KiÄé9Öº˘ ¶'ıŒ:{˜#¡c˚nv⁄°Æ ´ Í¨Ú #á‹&J¯®q˝yEcÇgºúWPã %—eë

*ÜHÜ˜

0b1 0 U

Reply

Answer 12

franlog Author

Level 1

10 points

Dec 2, 2013 1:02 PM in response to Linc Davis

Okay, It looks like you got it!!!

The activity monitor still shows traffic, but less than before and the CocoaPacketAnalyzer shows that the traffic is only internal, not external!

Is this already a known bug from iOS Maverick?

I will let the CocoaPacketAnalyzer monitor the traffic this night again (in Germany it is 22:00pm now) and will come back to you with the result tomorrow. Anyway: Many thanks for your help so far!

Frank

Reply

Answer 13

franlog Author

Level 1

10 points

Dec 2, 2013 9:43 AM in response to franlog

Reply

Answer 14

Joe Bailey

Level 6

12,237 points

Nov 30, 2013 9:25 AM in response to franlog

Check this How To Geek article on removing or disabling MDNSResponder. Just be aware that removing or disabling will also remove or disable some very handy network services in OS X.

Reply

Answer 15

franlog Author

Level 1

10 points

Nov 30, 2013 10:51 AM in response to Linc Davis

Hi,

the problem is not only the 70.000 packets a day. It is continously downloading from the internet and causes so about 1GB traffic on my internet connection.

Reply