mDNSresponder high sending bytes - Apple Community (2024)

PRP_53

88,567 points

Background on Etrecheck Application

At one time there was an Etrecheck Application available on the Apple Apps Store.

Due to certain constrains place upon the Developer by APPLE, the developer chose to remove it from the Store and make is available Directly from them.

This specific application is well known, on these Forums, as a Go To for trouble shoot and avoiding all the question / answer and question / answer to finally get the issue pinned down.

It is also known and reported by Reliable Sources that, sometimes APPLE SUPPORT has invoked using this same Developer Distributed Version of Etrecheck application to trouble shot computer issues

If you do a quick search on the Front Page of there Forums using " Etrecheck " you may find about 287 Posting related to the usage of this application

Lastly - should to decide to use and post the Report now or at a later time, we are willing to have a very close look and offer some insights

PS - I am not affiliated with nor do I receive any compensation from the Developer for suggesting using this application - Incase that may also be a concern you have

PRP_53

88,567 points

AppleProblem33 wrote:

Yes I have read that, but in my case I don’t understand why it is sending so many files, is this suspicious behaviour or is it completely normal?

That would be difficult to answer accurately without seeing what Applications are installed and used on this computer.

We can guess and surmise but I do not think you what that, do you ?

Download the Application Etrecheck directly from the Developer.

This is a Diagnostic Tool that makes no changes to the computer.

It makes a coherent and readable inventory of both the Hardware and Software used on the computer

The application is free or paid from added features.

The Report will Not Reveal Any Personal Information.

Post back the Full Report - copy and paste - >>>> using the Additional Text Icon ( 3rd Icon to last ) <<<<

In good faith - I have just run the specific application mentioned above - just to Test my machine

Refer to below " My Machine " file

PRP_53

88,567 points

Thank you too and same back

Only as my point of reference to an earlier concern

PRP_53

88,567 points

Here I will respectfully defer to my More Learned Colleague @ Tesserax for a much more in-depth explanation 🤞

What I can illustration in image below

Use a M1 Mac Mini with Ventura 13.5 and the Apple Bluetooth Magic Mouse 2 ( rechargeable Battery ) and the Apple Bluetooth Magic Keyboard 2 ( also with rechargeable Battery )

Connected via Wifi on 5 gHz network with a Fibre Optic ( 1.5 GB Speed ) to ISP Router

Sent Bytes 1.6 MB, Received Bytes 3.4MB, Sent Packets 3,347 and Received Packets 14,529

This machine has been in use since 04:00 Hrs EDT to current time 12:18 Hrs EDT = 8 Hours On and Running

Tesserax

150,555 points

The mDNSResponder process relates to the mDNS (multicast DNS) protocol that is used to discover devices on the local network. Network activity, around this process, is typically ... normal.

mDNS is also referred to as "Zero Configuration Networking" or "Zeroconf."

Where mDNS traffic increases is when there isn't a conventional Unicast DNS server located on the same network as the client. In this case, the client will rely on mDNS to locate other devices (than can respond to mDNS) on that local network.

If you are concerned about the amount of mDNS traffic, you can use a tool, like Wireshark, to perform network data captures to see what devices are "communicating" via mDNS. In addition, you could verify that whatever device (most likely your local network's router) is providing DNS services properly.

PRP_53

88,567 points

Just a quick note on WireShark and only from Observations on these Forums

It may provide the needed info.

Be aware it may load Extensions onto the machine which sometimes do and sometimes do not play well with the Operating System or at least with Normal Internet Connections

Tesserax

150,555 points

I don't think the story has changed, related to mDNSResponder.

However, I do appreciate P. Phillips's comments around Wireshark. The app will install an executable, ChmodBPF, as a Launch Daemon. This is how it is able to capture data packets. It is not loaded when the app is inactive, so it doesn't reside in the background. Regardless, interpreting Wireshark captures will require a fairly extensive background in understanding network protocols. If you are already comfortable with this topic, this tool will greatly aide in troubleshooting. Lastly, I do not have this app installed on my "main" computer. Instead, I have a dedicated "older" Mac that I use for network troubleshooting where this tool, and others, call home.

Tesserax

150,555 points

Let me see if I can add a bit more, without using too much techno-babble.

A popular implementation of mDNS is Apple's Bonjour. This service is primarily to more easily connect network printers to a Mac. It basically allows devices to respond to mDNS queries. Note; however, only devices with hostnames ending with ".local" hostname, would participate.

However, this in not only where mDNS is used. For example, web browsers based on Chromium (that includes Google Chrome, Safari, Microsoft's Edge, Opera, & Brave, etc.) use mDNS to locate printers when you print a web page. AirPlay is also heavily dependent on mDNS.

Finally, guess what else uses mDNS? Yep ... IoT devices do too!

So, you can see, although you can disable mDNS, most modern day devices rely on it.

PRP_53

88,567 points

Similar question from Earlier Version of macOS

You may what to refer to responses from Luis Sequeira1 and John Galt

What is mDNSResponder - and why is it run… - Apple Community

PRP_53

88,567 points

Tesserax

150,555 points