1

Using Wireshark, I found some unusual DNS queries that were ad-related. But I don't know which application was doing this. Is there any way to figure that out?

Improve this question

1 Answer 1

Reset to default
1

Most Cocoa apps (most OS X GUI apps) use networking APIs that use the mDNSResponder process to handle their DNS queries. Look at the mDNSResponder(8) man page for how to get debug information out of it. It involves sending it the INFO, USR1, and USR2 signals, and watching various log streams. That debug information may tell you which processes are making which queries.

Improve this answer
1
  • Finally got the key: sudo killall -USR1 mDNSResponder sudo syslog -c mDNSResponder -d I can find the PID in syslog.
    – Al3n
    Jun 30, 2014 at 13:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .