Disable Bonjour in Yosemite

[Jason]

Currently i'm unaware of a way to do this for Yosemite, so i'm hoping someone else has discovered a way.

This article effectively summarizes the situation:
https://gist.github.com/steakknife/b8e9c37d287f8b7d70ee

mDNSResponder is now gone in Yosemite, replaced by discoveryd. Adding in the "--no-multicast" argument to discoveryd does stop multicast (bonjour), but has the nasty side effect of messing up WiFi. I experienced that today while working from home where it had been able to connect to my personal WiFi, but after a reboot could no longer find ANY broadcast networks, or connect manually. Removing "--no-multicast" and unloading/loading it made WiFi usable again. Hopefully there is some bullt-in solution that doesn't require me to setup firewall rules to block the traffic.

[cshepp11]

Hello Jason,

Take a look at this article https://discussions.apple.com/message/27090155#27090155

I have not had a chance to test, but looks like it may work.

Thanks,
Chris

[Jason]

@cshepp It looks like that thread has two recommendations. One is to restart pf and the other is to create a pf rule to block the traffic. I'd prefer a way of disabling Bonjour which would cause the traffic to not be created in the first place rather than blocking the traffic with pf. Obviously, if that's the only way to do it in 10.10 then it is what it is, but i'm hoping there is a way to disable it instead of block it.

[alexmcclements]

This might work for you

http://apple.stackexchange.com/questions/151485/how-do-i-disable-bonjour-visibility-after-yosemite-install

[Jason]

Hi @alexmcclements , I've already checked that link unfortunately. The solution Jon Schwenn proposes is the same as the information in my original post (using --no-multicast in the discoveryd plist), but that breaks WiFi.

There is some discussion that the upcoming 10.10.4 release will get rid of discoveryd due to all of the issues it's caused and bring back mDNSResponder:
http://www.macrumors.com/2015/05/26/apple-discoveryd-replaced-with-mdnsresponder/

Hopefully if that is true then this won't be an issue any longer and the old process for mDNSResponder will work again.

[jrwilcox]

I think mDNSResponder may be back in 10.10.4.

[jsauer]

Hey Jason,
Did you ever find a solution for this? Thanks!

[eonl]

Is there a solution for this? we want to disable Bonjour in 10.11.3.

[davidacland]

I haven't looked recently but I suspect SIP would prevent this change on 10.11.x and if it is possible, it will break wi-fi and the Macs ability to perform any kind of DNS lookups.

[Jason]

I've been discussing this with CIS and Apple as well. The current stance is that it is possible to disable broadcasts, but SIP must be disabled first, which involves booting into recovery, disabling SIP, making the change to mDNSResponder, re-enabling SIP, then booting back into the OS. CIS isn't going to have this as a control in future versions since there isn't a easy way for enterprises to implement this today.

If anyone does come up with some magic to automate this then I think many would benefit.

[bpavlov]

Give Apple feedback so they can implement a control for this perhaps via a config profile.
http://www.apple.com/feedback/

[luke_jaeger]

"Any update on this?" he asked hopefully.

[Jason]

Firewall rule is about the best manageable approach i've seen.

[krispayne]

Check my code, but would this work? edit: I see above that SIP is possibly blocking this. My script comes from the audit/remediation guide of CIS for Yosemite.

#!/bin/bash

checkBonjourAdvertising="$(/usr/bin/defaults read /Library/Preferences/com.apple.alf globalstate)"
    if [ "$checkBonjourAdvertising" = "1" ] || [ "$checkBonjourAdvertising" = "2" ]; then
        echo "  Bonjour Advertising is off."
    else
        echo "  Bonjour Advertising is on. Shut it down."
        defaults write /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist ProgramArguements -array-add '{-NoMulticastAdvertisements;}'
        echo "  Bonjour Advertising is off."
    fi

[Jason]

@krispayne anything under /System cannot be modified while SIP is enabled (https://support.apple.com/en-us/HT204899). In Yosemite this would have worked fine. For El Cap this would no longer work.

[krispayne]

@Jason I see, thanks for clarifying

[Jason · Accepted solution]

Apple Developer Bug Reporting Team has responded back to me with the recommendations below. To validate if this works or not i'm using Wireshark with a filter of "dns and udp.port eq 5353 and ip.addr eq 224.0.0.0/24" and toggling Sharing options on/off to see if i get any MDNS traffic. Prior to setting this i did see MDNS traffic and after setting/rebooting i no longer saw it. I did also notice that changing to NO or deleting the PLIST and rebooting did not seem to bring the MDNS traffic back, so perhaps my test case is flawed or i'm doing something wrong. Others are welcome to test and provide feedback as i'm still waiting on feedback from Apple.

Starting in 10.11.x(El Capitan) on OSX, the options will be:
   DebugLogging, UnicastPacketLogging, NoMulticastAdvertisements, StrictUnicastOrdering and AlwaysAppendSearchDomains

To turn ON the particular option, here is what the user should do (as an example of setting two options)
   1] sudo defaults write /Library/Preferences/com.apple.mDNSResponder.plist AlwaysAppendSearchDomains -bool YES
   2] sudo defaults write /Library/Preferences/com.apple.mDNSResponder.plist NoMulticastAdvertisements -bool YES
   3] sudo reboot

To turn OFF all options, here is what the user should do
   1] sudo defaults delete /Library/Preferences/com.apple.mDNSResponder.plist
   2] sudo reboot

To view the current options set, here is what the user should do
   1] plutil -p /Library/Preferences/com.apple.mDNSResponder.plist
   OR
   1] sudo defaults read /Library/Preferences/com.apple.mDNSResponder.plist

[jhbush]

Looks like Rich just mentioned this on his blog Disabling Bonjour advertisement on OS X El Capitan and later

[Jason]

After 3 years of working on Mac I finally beat rich to posting a solution! haha

[annamentzer]

Hello, all! I was hoping to disable Bonjour Advertising in 10.12 but I can't seem to locate com.apple.mDNSResponder.plist. It is not present in /Library/Preferences. Does anyone have any further information on whether it has moved or whether the process of manipulating the file has changed? Thanks!

[mjsanders]

@annamentzer I did not test good, but that file does not exist by default, and by creating the file (with the proper settings) the Bonjour behaviour should be changed. Read Rich troutons blog post that is mentioned above to see examples.

[annamentzer]

@mjsanders Ah, that's it. I read Rich's article did not understand that it had to be created. Many thanks for the clarification!