2

I noticed that the mDNSResponder process on my machine accepted an incoming connection from the name given to my machine in relation to sharing capabilities (xxx's-MacBook-Pro.local) on port 53. Despite reading about the Wikipedia article on Bonjour, I still don't really understand what it specifically does.

In this case, was mDNSResponder trying to see what sharing capabilities were enabled on my machine?

  • I believe it's showing whether your machine's services will respond at all, or whether a given service is turned off in the Firewall. – Zo219 Dec 5 '15 at 1:06
2

Without more information about what monitoring tool you're using and exactly what it's showing, it's hard to say for sure what's going on. But I can tell you a little bit. mDNSResponder has three main jobs on OS X:

  • Sending out multicast DNS (mDNS aka Bonjour) lookups to the local network on port 5353 (and listening for responses). These include both looking up names (e.g. "I'm trying to contact somethingorother.local; what's its IP address?") and looking up available services (e.g. "what computers on the local network provide AFP file sharing services?").

  • Listening for and responding to mDNS lookups that apply to it. For example, if its Bonjour name is xxxs-MacBook-Pro.local and it sees a request for xxxs-MacBook-Pro.local, it'll reply with its IP address(es). Similarly, if you have AFP file sharing turned on and it sees a request for AFP servers, it'll reply ("Me! I'm xxx's MacBook Pro and I provide AFP service on port 548!").

  • Sending out normal (unicast) DNS lookups on port 53 to some DNS server (and listening for responses). Names that end in ".local" get sent out via mDNS; everything else (e.g. "www.apple.com") gets sent via normal DNS to the server(s) configured in the network settings.

If you're seeing activity on port 53, that's normal DNS. I'm not sure why you're seeing it as an incoming connection (unless it's really a reply to request you sent out?), or why the source would be your own computer. For those, I'd need more detailed info about what you're seeing.

  • I use Little Snitch. I don't have a screenshot but the information provided by the app is broken up into three sections. The first section details what app/process it is asking to connect (mDNSResponder), and the user (I can't remember if it was the system or the name given to my standard account). The second section details the hostname/IP address (xxx's-MacBook-Pro.local). The third section provides connection statistics - what port (53), total upload and download traffic (it was 0kb for both), [cont in next comment] – oats58459 Dec 5 '15 at 11:21
  • ...if the connection is still active upon looking at the network monitor (it wasn't), when the connection was occurred and the most recent time it connected to the hostname/IP address (first and last activity had the same time), and how many times it connected (this is the funny part - there were 0 successful and 0 unsuccessful. However, the colour of the statistic in the network monitor indicated that a connection of some sort had previously been made, which is strange). That's all the information provided by Little Snitch. The odd thing is I don't have any sharing options enabled. – oats58459 Dec 5 '15 at 11:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .