AC68U/380.65 OSX 10.8.5 spamming DNS - might not be Merlin related ;)

[wedwabbit]

Hi all,

I have an old Mac Mini that I use as the kids' Plex server. It's running 10.8.5 and has been trouble free for years as far as I remember.

I recently noticed a CPU spike on my AC68U and 'top' pointed to the dnsmasq process. I had a look at the log file (also running AB-Solution 3.0) and noticed the following entries:

Feb 12 17:26:36 dnsmasq[11125]: query[PTR] b._dns-sd._udp.0.1.168.192.in-addr.arpa from 192.168.1.11
Feb 12 17:26:37 dnsmasq[11125]: forwarded b._dns-sd._udp.0.1.168.192.in-addr.arpa to 8.8.8.8
Feb 12 17:26:37 dnsmasq[11125]: query[PTR] r._dns-sd._udp.0.1.168.192.in-addr.arpa from 192.168.1.11
Feb 12 17:26:37 dnsmasq[11125]: forwarded r._dns-sd._udp.0.1.168.192.in-addr.arpa to 8.8.8.8
Feb 12 17:26:37 dnsmasq[11125]: query[PTR] db._dns-sd._udp.0.1.168.192.in-addr.arpa from 192.168.1.11
Feb 12 17:26:37 dnsmasq[11125]: forwarded db._dns-sd._udp.0.1.168.192.in-addr.arpa to 8.8.8.8
Feb 12 17:26:37 dnsmasq[11125]: query[PTR] lb._dns-sd._udp.0.1.168.192.in-addr.arpa from 192.168.1.11
Feb 12 17:26:37 dnsmasq[11125]: forwarded lb._dns-sd._udp.0.1.168.192.in-addr.arpa to 8.8.8.8

They (or those much like them) were repeated thousands of times, hundreds per second and all coming from my Mac Mini. I understand these are reverse DNS lookups.

A reboot of the Mac made the problem go away but it has since reoccured. My searches seem to indicate (vague hints only) that it could be a DNS issue.

Has anyone come across something similar or have any suggestions?

Thanks

 

[tomsk]

Hi all,

I have an old Mac Mini that I use as the kids' Plex server. It's running 10.8.5 and has been trouble free for years as far as I remember.

I recently noticed a CPU spike on my AC68U and 'top' pointed to the dnsmasq process. I had a look at the log file (also running AB-Solution 3.0) and noticed the following entries:

Feb 12 17:26:36 dnsmasq[11125]: query[PTR] b._dns-sd._udp.0.1.168.192.in-addr.arpa from 192.168.1.11
Feb 12 17:26:37 dnsmasq[11125]: forwarded b._dns-sd._udp.0.1.168.192.in-addr.arpa to 8.8.8.8
Feb 12 17:26:37 dnsmasq[11125]: query[PTR] r._dns-sd._udp.0.1.168.192.in-addr.arpa from 192.168.1.11
Feb 12 17:26:37 dnsmasq[11125]: forwarded r._dns-sd._udp.0.1.168.192.in-addr.arpa to 8.8.8.8
Feb 12 17:26:37 dnsmasq[11125]: query[PTR] db._dns-sd._udp.0.1.168.192.in-addr.arpa from 192.168.1.11
Feb 12 17:26:37 dnsmasq[11125]: forwarded db._dns-sd._udp.0.1.168.192.in-addr.arpa to 8.8.8.8
Feb 12 17:26:37 dnsmasq[11125]: query[PTR] lb._dns-sd._udp.0.1.168.192.in-addr.arpa from 192.168.1.11
Feb 12 17:26:37 dnsmasq[11125]: forwarded lb._dns-sd._udp.0.1.168.192.in-addr.arpa to 8.8.8.8

They (or those much like them) were repeated thousands of times, hundreds per second and all coming from my Mac Mini. I understand these are reverse DNS lookups.

A reboot of the Mac made the problem go away but it has since reoccured. My searches seem to indicate (vague hints only) that it could be a DNS issue.

Has anyone come across something similar or have any suggestions?

Thanks

Yes... i have this here too...... its the dirty work of zeroconfig A.K.A bonjour.

Wiki says...
DNS-SD with multicast[edit]
Multicast DNS (mDNS) is a protocol that uses packets similar to unicast DNS except sent over a multicast link to resolve hostnames. Each host listens on the mDNS port, 5353, and resolves requests for the DNS record of its .local hostname (e.g. the A, AAAA, CNAME) to its IP address. When an mDNS client needs to resolve a local hostname to an IP address, it sends a DNS request for that name to a well-known multicast address; the computer with the corresponding A/AAAA record replies with its IP address. The mDNS multicast address is 224.0.0.251 for IPv4 and ff02::fb for IPv6 link-local addressing.

DNS service discovery (DNS-SD) requests can also be sent over a multicast link,[20] and it can be combined with mDNS to yield zero-configuration DNS-SD. It still uses DNS PTR, SRV, TXT records to advertise instances of service types, domain names for those instances, and optional configuration parameters for connecting to those instances. But SRV records can now resolve to multicastable .local domain names, which mDNS can resolve to local IP addresses.

Support[edit]
DNS-SD is used by Apple products, most network printers, many Linux distributions including Debian and Ubuntu,[21] and a number of third party products for various operating systems. For example, many OS X network applications written by Apple, including Safari, iChat, and Messages, can use DNS-SD to locate nearby servers and peer-to-peer clients. On Windows, the operating system includes support for DNS-SD at least on Windows 10 for applications written using JavaScript[22] and other languages may be supported shortly. Individual applications may include their own support in older versions of the operating system, such that most instant messaging and VoIP clients on Windows support DNS-SD. Some Unix, BSD, and Linux distributions also include DNS-SD. For example, Ubuntu ships Avahi, an mDNS/DNS-SD implementation, in its base distribution.

Service types are given on a first-serve basis. A service type registry was originally maintained by DNS-SD.org,[23] but has since been merged into IANA's registry for DNS SRV records.[24]

Merlin firmware has avahi which you might notice running in 'top'

1338     1 tOmsK S     2052  0.8   0  0.0 avahi-daemon: running [RT-AC68U-4690.local]

 

[wedwabbit]

Thanks That's very helpful.

I found a post describing how to disable Bonjour multicast advertisements here: http://apple.stackexchange.com/ques...ble-bonjour-visibility-after-yosemite-install

I'll give it a go and update the thread.

 

[wedwabbit]

Ok - it's been two weeks and I haven't had a single reoccurrence of the original problem