PeerGuardian entry - what is it?

[ggeobc]

I am using a freebee program called PeerGuardian to help keep out intruders. It is blocking this entry:

Fri Oct 28 2011 21:06:14.974 PDT -Blck- local:5353 (mdns) -> 224.0.0.251:5353 (mdns) udp4 'mDNSResponder (25)' (Bogon:Ads, Spyware, Bogon, etc)

This entry appears often in the PeerGuardian blocked entries window. I am assuming it is blocking some kind of spyware program I have inadvertently down loaded via some other download and it is attempting to send information from my MacBook to the url 224.0.0.251:5353, am I correct? How should I be reading this -English translation, please?

If this is spyware, how would I go about finding it on my MacBook and get rid of it permanently?

 

[dtravis7]

If I were you I would leave that alone. Read this.

Mac OS X v10.6: Disabling mDNSResponder will disable DNS

What is this PeerGuardian app? Sounds like it's wrong.

 

[Kevriano]

@dtravis7
Peerguardian is used to potentially blocked unwanted snooping from the authorites like the RIAA when you are torrenting illegal music/movie files etc.
It's a plug in for Vuze and uTorrent.
It also does not work, should not be necessary (if your legal, you don't need it), and causes no end of issues.

 

[TattooedMac]

It also does not work and causes no end of issues.

Sounds like another MacKeeper and will suck peoples in by the sounds. At least it is free hahaha

 

[dtravis7]

@dtravis7
Peerguardian is used to potentially blocked unwanted snooping from the authorites like the RIAA when you are torrenting illegal music/movie files etc.
It's a plug in for Vuze and uTorrent.
It also does not work, should not be necessary (if your legal, you don't need it), and causes no end of issues.

Thanks for the info Kevin, Been busy all night or would have googled it. Does not sound like a good thing at all and trying to shut down DNSResponder which apple says will stop DNS lookup is not a good thing!

 

[bobtomay]

224.0.0.251 is a reserved address used on local networks for multicastDNS - is not an available internet IP address - it is specifically used by Apple's Bonjour service to discover other services on your local network and to collect the IP addresses of the other computers on a local network without a DNS server.

Kevriano is quite right that PeerGuardian does not work. PG should be removed - It has been the root cause of a lot of connection issues we've seen here.

 

[SFBloodBrother]

Get some anti virus.

 

[dtravis7]

Get some anti virus.

For what? There are no true Virus's on OSX and MDNSResponder is NOT a virus. It's part of OSX's network. Get rid of that and have fun surfing the net with no domain names.

 

[Ttaylor394]

Get some anti virus.

That made me laugh

 

[ggeobc]

I don't pretend to be any kind of expert, I'm far from it, but this is what this dummy has found out:

A bogon is a bogus IP address, and an informal name for an IP packet on the public Internet that claims to be from an area of the IP address space reserved, but not yet allocated or delegated by the Internet Assigned Numbers Authority (IANA) or a delegated Regional Internet Registry (RIR). The areas of unallocated address space are called the bogon space.

Many ISPs and end-user firewalls filter and block bogons, because they have no legitimate use, and usually are the result of accidental or malicious misconfiguration. Bogons can be filtered by using router ACLs, or by BGP blackholing.

Examples: (from PG's block list)

(http) tcp4 'Safari Webpage Preview Fetcher (573)' (Valueclick.com Karl Keyton:Ads, Spyware, Bogon, etc)

Sun Oct 30 2011 18:47:07.473 PDT -Blck- local:0 -> 74.121.176.40:80 (http) tcp4 'Safari Webpage Preview Fetcher (573)' (Kontera Technologies Inc:Ads, Spyware, Bogon, etc)

Sun Oct 30 2011 19:03:28.427 PDT -Blck- local:5353 (mdns) -> 224.0.0.251:5353 (mdns) udp4 'mDNSResponder (25)' (Bogon:Ads, Spyware, Bogon, etc)

As you can see, several entries in PG's block list are from the Safari webpage preview fetcher. PG isn't filtering out all of Safari's work as I am getting top sites listed such as CNN, E-bay,etc., these would all have ip's registered with IANA. The entries PG is blocking would be companies that may be new and are not yet listed with IANA, in other words, bogons.

Conclusion: PG is doing it's job, protecting my MacBook from unauthorized attempts to access my computer which would be done by using bogus ip's, among other methods. It may be a little too good, in that it is also blocking the mDNSResponder which, in my opinion, it should not be doing as it was designed for Mac users. I could care less about torrents, I am using PG to prevent intruders from hacking into my Mac and prevent spyware from probing my Mac as I do on-line banking and shop on-line as well.

I don't believe it is designed to be used on a network, it is meant to be used on a single Mac connected to the Internet, probably why bobtomay was having problems with it, you were using it on a network, right?

I am not religious about PG. If anyone knows of anything better then please, tell us about it. I am mostly concerned with protecting my Mac from unwanted intruders.

 

[dtravis7]

MDNSResponder is doing exactly what it's supposed to be doing. Zap it and see what happens. You will not like the end result.

 

[chas_m]

I am mostly concerned with protecting my Mac from unwanted intruders.

Intruders CANNOT get into your Mac, so this is a complete non-issue and a waste of your time and resources.

Don't take my word for it ... turn every protection system you have completely OFF and then visit https://www.grc.com/x/ne.dll?bh0bkyd2

See for yourself.

 

[sunshineshade]

I saw something under system preferences Network, advanced TCP .It said configure.I googled it and someone said if you change it to manual instead of automatic( IPv6) it is better for the computer.I do not know that much about this..Anyone please?

 

[bobtomay]

I have never had problems with it as it has never been on any of my computers.

What I have seen is countless issues (just like this one - with it reporting something to be a problem that's not) on this forum and others of people not being able to connect to the web - in some cases anything, but most of the time only a few sites - and the issue was resolved by removing PG.

Personally, I use my router's built-in firewall.

There is no such animal as a 224.0.0.251 url out there on the web. That IP cannot be used as an external address trying to get into your local network. That IP is reserved for internal (local area) networks - similar to 198.162.0.* Just try doing a Whois lookup for that IP anywhere you would like.



(Leave the IPv6 settings as they are unless you are having specific issues with it. There is no need to be messing with it. There was some issue with the automatic setting some 4-6 yrs ago that was causing DNS problems and the recommended fix at that time was to change it to manual. I have not seen this issue in a few years now.)

 

[sunshineshade]

Thank you.Someone on the web said if they have your ip address ,they can spy on what websites you go to.Is that true?It happened to me when I was using windows before I switched to mac.My computer was so sick So naturally I am a little paranoid.

 

[chas_m]

It's rubbish.

You're not on a PC anymore, you're on a Mac. It's different. So think differently.

 

[ggeobc]

https://www.grc.com/x/ne.dll?bh0bkyd2 is a Windows-DOS oriented site, not much to do with Macs, I'm afraid. I wouldn't rely on this site to check out how secure a Mac is. The programs and services they offer are strictly Windows oriented.

 

[dtravis7]

Nope, that test there is for ANY computer on the internet. It's not just for Windows. Only his Spinright hard drive SOFTWARE is for a PC.


https://www.grc.com/x/ne.dll?bh0bkyd2


Shows open ports. If you have a router with a true Firewall and any ports are open, Your Firewall is not configured correctly. I have been using that site for years with Linux, OSX and Windows systems.

If you really feel OSX is that unsecured and that easily compromised, maybe it's time to go back to Windows, the hallmark of security.


Show me a TRUE Self Installing and Self Replicating Virus for OSX. All the reports by those so called security sites are either lies or Malware that must be allowed to install and easily removed.

I have tried every one of them BTW. Only one did anything and that was just redirect IP's. I removed it in 15 seconds from the Terminal. I had to almost fight to get it and get it installed.

I hope all this so called Virus stuff with OSX is not some form of Trolling.

 

[bobtomay]

Modified the title of the thread since this is not really about spam, but about a particular entry in PG just in case anyone else comes along looking for the same info.