DNS upload traffic via Eddie

[Macppl 2]

I am using Eddie 2.11.11 in MacOS 10.12.3, and always has a question for mDNSResponder (the process that MacOS uses to resolve DNS to IP).  As shown in the attached captured screen, my network montior shows mDNSResponder has continuous upload traffic via 10.x.0.1, which should be created by Eddie during connection to AirVPN, even there is no computer and network activities.

 

I notice that when I browse a website, there will be instant download traffic to resolve DNS, and I think that is normal. But I wonder what is the continuous upload traffic?  Is that normal and intended design by Eddie? Could staff please explain?

mDNSResponder.tiff

[zhang888 1066]

There are many background services that rely on DNS, also Little Snitch is using DNS to resolve hostnames in the statistics.

[Macppl 2]

There are many background services that rely on DNS, also Little Snitch is using DNS to resolve hostnames in the statistics.

 

​However, the continuous upload situation will only occur after Eddie connects VPN and DNS server IP is changed to 10.x.0.1. Could you confirm the traffic was not by Eddie?

Moreover, it is weird that the upload traffic seems unable to be seen in Speed tab of Eddie and Activity Monitor of OSX.  Anyway, I have also asked Little Snitch and will update here if any.

[Macppl 2]

 

There are many background services that rely on DNS, also Little Snitch is using DNS to resolve hostnames in the statistics.

 

​However, the continuous upload situation will only occur after Eddie connects VPN and DNS server IP is changed to 10.x.0.1. Could you confirm the traffic was not by Eddie?

Moreover, it is weird that the upload traffic seems unable to be seen in Speed tab of Eddie and Activity Monitor of OSX.  Anyway, I have also asked Little Snitch and will update here if any.

 

Little Snitch have replied me that the traffic are not generated by them, and they do not realise any bugs regarding to my situation. The situation still occurred even when I set DNS to others (e.g. 8.8.8.8) or stopped the Network Filter. However, now I find a solution to use DNSCrypt or VPN-->Tor, then filter all mDNSResponder traffic to bypass it. Of course those methods are inconvinent, and any users find continuous upload traffic will be worried about security.

I have also captured packets from mDNSResponder using their Network Monitor, and find those continuous upload should be DNS query packets from 0.0.0.127 to 10.x.0.1. (as attached tiff). If they are normal DNS query response, they should be resolved by AirDNS, but they just repeat continuously. Would staff please investigate whether they are induced from Eddie?

Please note that Little Snitch monitor / filter network traffic based on Application Layer. Any more ideas? Any Mac users have same situation? If just me, then my machine may be compomised.

Captured upload DNS traffic.tiff

Edited ... by Macppl