What app is using mdnsd if I don't have Firefox and draining my battery on samsung galaxy s3

[AC Question]

For the past several weeks my Samsung Galaxy SIII battery has been draining almost completely 3x/day. In Settings I checked the Battery usage and find it's Mdnsd that's using all the battery. An online search tells me it's associated with Mozilla Firefox which I don't have. It is also associated with drone app use, again which I don't have. I'm also having trouble using Google Maps in that it tells me it cannot search right now and when it does work, it won't give me directions even though I have the voice directions checked. I've uninstalled/reinstalled GoogleMaps a couple of times and it will work for a while and then quits again. So I have two problems. Any insights? I'm using Tracfone's Total Choice which only supports 4.1.2 os so I cannot do any updating.

 

[henryw48]

@Huku: Thanks very much for your suggestion about checking out Ping & DNS. I just removed it last night and it appears to be the culprit in our cases. Looking on the Google Play site, I see that there were numerous complaints about a new feature called NetSentry that monitors network interface traffic. People tried to turn it off and couldn't. Supposedly the author has fixed the problem as of the 1/2/2017 release. However, whether it is fixed or not, it did not fix our problem. I had the latest release on my phone and the socket count problem was still there.

I have Ping & DNS on my tablet also, but don't have the problem. It is only on the Samsung Galaxy S3 phone. That might be because the phone is old and the latest Android kernel that Verizon and/or Samsung has released for it, is the 4.4.2 (KitKat) version or as I had said earlier, the old phone may not be able to keep up with the work.

In either case, as soon as I had removed the Ping & DNS, I noticed that the number of UDP and UDP6 sockets for port 5353 had stopped growing. When I rebooted, the "mdnsd" process was not running any more and the number of UDP sockets for port 5353 was just 1 or 2. It has been many hours, and by now, the number of sockets would have grown. So I consider this problem resolved for me (unless of course it reappears, which I don't expect).

 

[Devils Advocate1]

My wife solved the mdnsd problem on her Droid today by removing the "WeatherBug" app.

 

[henryw48]

Not surprising that there may be more than one solution, depending on what apps were loaded on the device and what kind of device it is. Glad your wife found the problem on her device, Devils Advocate1.

I suspect it might be a load and device capability problem (i.e. the straw that breaks the camel's back). Even with an app that has been on the device for a long time, the apps change with new features added, as was my case.

 

[Huku]

Hi Everyone,

it's been already 4 days since 03.Jan.2017 and the mdnsd problem is gone!

How did this happen?

Well, as I wrote earlier I uninstalled Ping&DNS app and since then there is absolutely no problem, altghough I've been using my phone heavily (navigation, reading, watching videos, etc.).

Meanwhile I stopped the auto-update of all other apps so I am sure nothing else has changed. The only apps that "slipped through" and updated on the same day (3.Jan) are (1) MyKi Watch (2) Peak. I am 99% sure they have nothing to do with mdsnd problem because they updated on the same day but before I remove Ping&DNS.

@henryw48: The 4.4.2 is very good observation! I am using the same version of the OS on my Galaxy S5 phone (although I can update it, but don't want to) and that is almost for sure the reason that you reproduce the problem on your phone but not your tablet.

And one more thing - a big thank you to all of you for all the efforts and time invested in solving this issue. Hopefully this thread will help other people also.

 

[anon(10132667)]

Were you able to get rid of MDNSD? If so, how?

 

[Devils Advocate1]

mdnsd came back today. Still not using Weatherbug so something else is triggering it too.

Will keep you updated.

 

[henryw48]

@bwg0719: On my device and also on Huku's device, the problem was being triggered by the updating of the installed Ping & DNS app. It had gotten updated in December 2016 and again in January 2017. As soon as we removed that app, the problem went away. Before those updates, Ping & DNS did not cause a problem. It appears that Ping & DNS had recently added a new feature to the app to monitor traffic on the network interfaces. That either presented extra load on the network interfaces or somehow interfered with the running of the system daemon program /system/bin/mdbsd, causing it to fall behind and lose packets and sockets and eventually enter a looping state draining the battery. Both Huku and I were running different devices but happened to be running the same version of the Android OS. I also have a tablet, which is newer and faster and running a later version of the Android OS. It did not have the problem even though I had also installed Ping & DNS on it.

 

[vice86]

Note 3 user here. Been up for a little over 5 hours now and i just saw my phone screen turn on, look at it and its low battery warning. in about 5.5 hours my battery has drained from 100% to 15%!!! Looked up battery usage and there was "mdnsd". Never seen this before show up on my battery list. I did notice the other day I saw the Nearby Devices show up on battery but I had the option off so not sure why it even showed up.

Looking at my recent in stalls, a sneaker app called GOAT was my last install. Deleting now to see if that for some reason makes a difference.

 

[henryw48]

@vice86: By "recent installs", did you mean "Recently updated"? You need to look at all apps that were "Recently updated" as possible culprits, especially ones that might cause significant amounts of network traffic.

"Nearby Devices" is not something I'm familiar with, but is definitely something to look at. One of the functions of "mdnsd" is to look for nearby devices by implementing the bonjour nearby device discovery protocol. One of its functions is to find nearby internet connected printers and other IoT devices without you having to know their Internet Protocol (IP) address. It is also used to do domain name resolutiion (translate an address such has "forums.androidcentral.com" to an IP address that the software can use).

Look at all the apps that were recently updated by looking at Google Play's description of the app, including the "READ MORE" section, and the "Permission details" at the bottom of the bottom of the app description.

 

[CarolaVw]

I've got also the mdnsd problem.
I've got a samsung galaxy S3 mini.
What is happening on my phone is that when I start the Facebook app, my phone is restarting automatically. So I think that there is possably a link with the mdnsd and the facebook app.

Sorry for my bad English, I'm a Duth girl.

 

[henryw48]

@CarolsVw: How did you determine it is the mdnsd problem? Did you see the mdnsd come up in your battery app display? The reason I ask is because this problem doesn't seem to be behaving the same way as the problem we've been working on in this thread.

It almost sounds like you may have too many apps running at once and are running out of resources.

I had taken the Facebook app off my Samsung S3 a long time ago and only used the web based access to Facebook. I don't remember exactly why, but I think I had some problem with it.

 

[CarolaVw]

@henryw48 I determined the problem by looking at the battery app display. There it came up as a high usage of the battery. And I was reading this treat, and I recognized a lot of what my phone is doing.
The mdnsd is decreasing after charging my phone. And sometimes my phone wouldn't charge up to 100%. So I need to turn my phone completely off to recharge.
A friend of my is a IT-boy. He suggests me to remove my SD card. So I did this evening. My phone is already a lot faster and I will keep an eye on the battery usage to see if the problem appears again or not.

 

[henryw48]

@CarolsVw: It certainly sounds like you may have a version of the problem. Once the mdnsd comes up as a high user on the battery display, the only way out is to restart. Since you said that the device is restarting by itself anyway, It would stop that. However, the battery display will not reset until you have fully charged the device and then disconnected the charger.

Some people seeing this problem had tried taking out the SD card. Don't think it was effective if removing the problem. However, it may work for you, so it's worth a try anyway.

Glad you have an IT friend helping you out. They might have some insight into the problem.

 

[Devils Advocate1]

I've got also the mdnsd problem.
I've got a samsung galaxy S3 mini.
What is happening on my phone is that when I start the Facebook app, my phone is restarting automatically. So I think that there is possably a link with the mdnsd and the facebook app.

Sorry for my bad English, I'm a Duth girl.

Got rid of mdnsd problem for a couple days by removing weather apps but now it's back and Facebook is not running correctly and mdnsd is back again. So I agree whatever the problem is that Facebook may be a culprit too. Interesting problem for sure.

 

[wireshark007]

I'm having the same problem on my S3. "mdnsd" is top battery drain by far. Also noticed that WIFI was never sleeping on my phone (even with screen off). With WIFI and mobile data off, the problem goes away (till WIFI is re-enabled). Did some packet sniffing on the WIFI network, and noticed that there are a few different formats of mdnsd packets emanating from my phone. There is a certain packet that is send in bursts every few seconds that seems to correlate with the problem - it looks like this: "1195 1459.768041 192.168.0.4 224.0.0.251 MDNS 316 Standard query response 0x0000 PTR, cache flush Android.local PTR, cache flush Android.local A, cache flush 192.168.0.4 AAAA, cache flush <address> NSEC, cache flush 4.0.168.192.in-addr.arpa NSEC, cache flush 8.D.C.A.1.F.E.F.F.F.A.8.0.3.A.8.0.0.0.0.0.0.0.0.0.0.0.0.0.8.E.F.ip6.arpa NSEC, cache flush Android.local OPT".

After reboot, these packets do not occur. As soon as I launch Facebook app (and no other app does this) the MDNS messages start, and continue even after shutting down Facebook (directly and in the application/task manager) until I reboot the phone (the messages temporarily stop when I turn off phones WIFI).

I subsequently deleted my Facebook application cache - this resulted in my phone rebooting each time I try to start the Facebook app.

I subsequently uninstalled Facebook entirely. This appears to have solved the problem.

I subsequently reinstalled Facebook, the MDNS problem and associated packet stream was back.

So I'm pretty sure Facebook is triggering the problem, even if the problem is in the MDNS service.

 

[henryw48]

@wireshark007: Good detective work and explanation. Yes. There appears to be several ways of causing the failure. Still don't fully understand the mechanism of the failure, but your analysis reaffirms one of scenarios that I thought was happening.

As I understand it, mdnsd is an Android daemon process that provides DNS services as well as the local device discovery service for the local network (bonjour or multicast zero-config networking). The purpose is to translate a qualified name into an appropriate IP address for the service or device. I THINK the bonjour or multicast zero-config networking works by responding with a mapping dump when it sees a query for a local service or local device it knows about. Hence it can generate a lot of local network traffic. I SUSPECT that when there are too many responses from various other devices, a local mdnsd gets overloaded with too much traffic coming in all at once, the system starts dropping response packets and running out of buffers. When certain other processes such as the new Ping & DNS, or Facebook are running, it contributes to the packet loss and utilization of the network buffers aggravating the situation. When the local system finally gets to the point where there are no buffers left, it goes into a loop trying to write responses. At this point, the loop causes the full utilization of one of the CPUs and the draining of the battery. As I say above, this is my GUESS as to what is happening. This appears to be prevalent on certain releases of the Android OS and/or running on older/slower hardware.

 

[timinaust]

Hi, I too have the problem with mdnsd and the flat battery - on a Samsung Note 2 on Android KitKat 4.4.2 which has been going flat several times a day. Just thought I would offer some thoughts from my investigation. Sorry for the very very long and probably rambling technical post.

mdnsd (aka Bonjour on Apple, Zeroconf etc) has two bugs that Google fixed between Android 4 and Android 5 (according to Android Open Software Project).

The main bug was titled 'Fix mDNS socket leak during network configuration changes' and this was fixed in March 2014 by a clever person at Google, however the fix doesn't appear until devices with Android 5 Lollipop. This bug could 'eventually lead to failure of the mDNS daemon when its file-descriptor table fills up with orphans.' - which is exactly what appears to be happening on my phone as the number of network sockets attached to the mdnsd service builds to about 580 (on my phone it adds about 28 orphans with each network config change - and network config changes reliably include anything WiFi, Mobile Data and Charging state). Soon after reaching the magic 580, the mdnsd service goes into a high CPU utilisation (100% of one CPU core), presumably as it fails to acquire additional sockets. As it does this, the power management decides the phone is really busy, increasing the speed of, and power to, the CPU cores, the battery consumption goes way up and the back of the phone gets hot. The only fix is a reboot.

However this is not the only problem - after all, the bug has been there since Android 4.4.2 was released, so something changed in November/December that is triggering the bug a in a big way. So what was that? Given that any application that wants to use mdnsd is required to install with CHANGE_WIFI_MULTICAST_STATE permission, a look with Permission Explorer (from Play Store) shows a limited set of applications that have that permission on my phone. They these basically fall into 4 groups - Nearby Devices/WiFi Direct, a bunch of Printing services, some Samsung stuff and Google Play services (which includes all the google services like backup, the sync services, gmail, maps etc etc etc and which is totally different to Google Play Store). (and a couple that I uninstalled while testing).

A look at the network traffic to see what is being queried with using this multicast DNS shows a separate query for general _Android_ devices (probably from Nearby Devices and/or WiFi Direct bypassing mdnsd), plus one regular consolidated query (which is what mdnsd is designed for) looking for things like printing (_IPP_), file sharing (_SMB_, _FTP_ etc) and a range of other standard sharing type services which could come from any of these apps that have the right permission. Given Nearby Devices and WiFi Direct are part of the Android 4.4.2 build, and my printing services haven't been updated, this leaves the Samsung stuff and Google Play Services. As people are reporting the same issues on non-Samsung devices - to me this (probably) points to something in the vast array of stuff lumped under Google Play Services. Google released V10 (up from V9) of play services in late October 2016 which would have rolled out probably in November or early December.

For me there are a number of possible 'official' remedies ... update to Android 5 or above - which I can't on my Note 2, but others may be able to (Check you don't have automatic update disabled on your phone); persuade Google to investigate whether something they did in Play Services V10 is triggering this 'old' bug on this 'old' version of Android and then fix Play Services - or buy a new handset. None of these seem particularly likely outcomes.

So I have been looking at alternative strategies. At the moment, I have rooted the phone and am running a script that restarts the mdnsd service every 30 minutes (#setprop ctl.restart mdnsd). This clears out the orphan network sockets caused by the bug which will hopefully stop the mdnsd service from getting into trouble and flattening the battery. Given how mdnsd works, this shouldn't cause application problems as long as it doesn't get restarted too often. If the script proves to work for a few days, I will investigate how to automatically start the script on boot from within android (you can't restart mdnsd from within a normal app). If regularly restarting the service doesn't work, and it turns out the orphan sockets are just becoming invisible, I will investigate whether replacing the mdnsd executable with one from a similar Android 5 phone fixes the problem, or whether I can use Android Open Source to re-build the executable after applying the patch changes.

I will report next if/when I get to a final solution - but I fear the solution won't sound like good news if you are not very technically minded - unless you finally want to justify a new phone.

 

[henryw48]

@timinaust: thanks very much for your very detailed description of your in depth investigation of the problem. It was very informative and confirmed some of my suspicions. Will be waiting for further updates from you or others who have taken further steps to resolve the problem. It appears that I will either have to root my phone or get a new one. Verizon/Samsung hasn't sent any more updates out for my phone for years, forcing the issue. The other alternative is what I'm doing right now; not running any of the apps that trigger this problem.

@timinaust: One additional note. I have found that restarting the device before the number of UDP and UDP6 sockets reaches over 500 does work. I just look at a netstat output or count the number of lines in /proc/net/udp and /proc/net/udp6. All the offending sockets are on port 5353 (0x14E9).

 

[CarolaVw]

Until today my mdnsd did not appear in the battery.
I used all my apps exept facebook.
Today I deinstalled the app and did a reinstallation of de facebook-app.
And now the problem is back.
So I really think that there is a link between the mdnsd and Facebook.
So I will replace my sd-card, because I have not enough memory for taking pictures.
And I will not using the facebook-app.
Then I will see what is going to happen.

 

[henryw48]

@CarolaVw: sounds like a good plan. From what others have posted Facebook app is one of the apps that causes trouble. The sd-card doesn't cause the problem.