1

Using the activity monitor, I can observe that mDNSResponder has sent, after a while, 595 KB and received 313.8 MB.

Some details about my network topology: I connect with WiFi to an Android phone and a Windows 8 computer was on the same local network. I’d like to know if an any situation this would use tethering data which can be costly in some countries per MB sent/received.

I know that mDNSResponder is a legitimate macOS process.

My question is how can I limit the traffic generated by mDNSResponder in order to avoid it running up a data bill.

Is this possible?

2

Despite its name, mDNSResponder handles both local multicast DNS ("mDNS", which will not be adding to your cell bill), and regular unicast DNS (which is not generally local, and will be adding to your cell bill). The figures in Activity Monitor don't distinguish between the two. My guess is that most of the traffic is local (mDNS is a bit chatty), but you'd have to run some tests to be sure.

There is a way to cut down on actual DNS traffic: a lot of the DNS lookups your computer is doing are probably from web ads, and some forms of ad blocking will prevent those lookups. Unfortunately, I haven't looked at this in a while, and don't know which types of blockers work early enough to prevent the DNS lookup. Essentially, there are three levels at which a blocker can work:

  • Detect and block ad content very early, and block fetching the ad content before the DNS lookup is done (leading to minimal network traffic).
  • Detect and block ad content after the lookup is done, but before the ad content is fetched (leading to slightly more network traffic).
  • Detect and block ad content after it is fetched (leading to full network traffic, ads just aren't displayed).

One ad-blocking method that's guaranteed to work at the first level is installing an alternate /etc/hosts file with faked entries for known advertising server domains. There are a variety of these available, for instance at Steven Black's github (which has a bunch of them with different groups of servers, also has scripts for building your own). If you want to do this, there are installation instructions here, although I'll add one step: make a backup copy of the original /etc/hosts file first!

  • So, you're saying that mDNSResponder handles legit DNS traffic. Without that, how is the OP supposed to browse the web? Still, measuring traffic on an internal node for traffic bound to the Internet is in no way an accurate picture of what's being send/received. – Allan Jan 4 at 22:22
  • @Allan Blocking all DNS would make the web unusable, but that's not what blocking via /etc/hosts does. The idea is to include hosts entries only for ad servers. For example, the one I linked blocks a whole bunch of doubleclick.net servers (that's an advertising network), but nothing under wikipedia.org. There are some tradeoffs here; for example, the standard list doesn't block google-analytics.com -- it'd be good to block it in principle, but many sites don't work right without it. – Gordon Davisson Jan 5 at 0:43
  • Did I say "block all DNS?" My question to you was rhetorical. Local traffic stays local, Outbound legit DNS traffic goes out. – Allan Jan 5 at 0:48
1

Looking at the traffic from a node on your local network (your Mac) to your router (your Android phone in tethering) is not going to give you an accurate picture of what network traffic is going out to and in from the Internet. Just because your Mac generates network packets doesn't mean that the router/gateway forwards them on. To accurately see what's being sent, you need to look at the traffic at the router/gateway.

However, for the purposes of this question, this is a moot point as all the traffic is local.

My question is how to limit the traffic generated by mDNSResponder in order to avoid spending money unnecessarily....I was connected with WiFi to an Android phone and a Windows 8 computer was on the same local network.

How do we know that the traffic from mDNSResponder is local only?

We know it's the process that handles the local zero config protocol also known as Bonjour. The traffic that you are seeing is between your Mac, the Windows 8 machine and the WiFi side of your Android phone.

  • But what about Wide Area Bonjour? – Ortomala Lokni Jan 4 at 20:25
  • Do you have your own DNS server configured to handle the wide area requests? If you didn't configure one and configure your Mac to use said DNS server, Wide Area Bonjour is not applicable. – Allan Jan 4 at 20:27
  • No, I don't have configured wide area request. Do you have a clue on the content of the received 313.8 MB? – Ortomala Lokni Jan 4 at 20:32
  • More than likely, it's responses from the Windows 8 machine. To know what the content is exactly, you need to put a sniffer (Wireshark) on the WiFi side and capture the packets. – Allan Jan 4 at 20:37
  • This isn't quite correct, since mDNSResponder does unicast DNS as well as multicast. See my answer for more info. – Gordon Davisson Jan 4 at 22:16
1

On MacOS there is a way to greatly reduce mDNSResponder's traffic on the local network.

From the manpage for mDNSResponder:

OPTIONAL ARGUMENTS
 mDNSResponder accepts the following optional arguments:

 -AlwaysAppendSearchDomains
                            Append search domains for multi-labeled Partially Qualified Domain Name as well as single-labeled Partially
                            Qualified Domain Name.  This argument is not recommended because of the extra DNS traffic it generates and
                            its adverse effect on battery life.

 -NoMulticastAdvertisements
                            Prevent the system from advertising Bonjour services via Multicast DNS.

 To cause mDNSResponder to run with these optional arguments when it launches on OS X 10.11 (El Capitan) and later, set the
 AlwaysAppendSearchDomains or NoMulticastAdvertisements boolean keys to true in /Library/Preferences/com.apple.mDNSResponder.plist and
 reboot.

The second option will stop mDNS from broadcasting bonjour availability, although I don't think it's Bonjour traffic that is your problem, that traffic won't leave the network. I believe you can use a configuration profile to duplicate this on iOS.

Because of recent security news, most of it bad, you might want to take some time to make sure that some apps are not ferrying screenshots of your screen, or, in my case, slyly pumping out half a gig in the dead of the night.

I found turning off bluetooth at night stopped this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .