avahi-daemon constantly reporting "Invalid response packet from host"

Status changed to 'Confirmed' because the bug affects multiple users.

I get this error at the exact time my WiFi traffic freezes for a a while. Has anyone else noticed ths?
Machine: Dell Precision M3800
Wireless adapter: Intel Corporation Wireless 7260 [8086:08b1]

I regularly lose my internet connection in the office (where there are alot of OSX laptops) and every time I see the 'Invalid response from host' message from various ip adresses (ipv4 and ipv6, usually ipv6 after a disconnect).

This is on a dell precision M3800 with Intel Corporation Wireless 7260.

Just not logging the error does not seem like a good solution to me, if these are related.

I see this error when I use my iPad TiVo app - the error comes simultaneously from all TiVo devices on my lan.

The traffic appears to be "private" traffic between related devices that do not follow the mdns spec - (Multicast DNS Responses MUST NOT contain any questions in the Question Section. Any questions in the Question Section of a received Multicast DNS Response MUST be silently ignored.)

But to honor the spec Avahi should silently ignore the traffic.

IMHO, the error should not be logged.

This bug has been raised with Avahi as http://avahi.org/ticket/352 but there doesn't seem to have been any action on this in 4 years.
I'm going to contact them. I've got tcpdump's of the packets.

I'm seeing these apparently bad packets come from a Windows 10 pre-release build 10240 machine. I guess I'm going to see a lot more with Windows 10 being offically released on 29/7/2015.

These messages are appearing in syslog for my machines:
Ubuntu 12.04 avahi-daemon 0.6.30-5ubuntu2
Ubuntu 14.04 avahi-daemon 0.6.31-4ubuntu1

Looks like server.c code used in Ubuntu Wily 15.04 has not had the patch above applied.
See http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/wily/avahi/wily/view/head:/avahi-core/server.c
Vivid 14.10 + Wily 15.04 both use 0.6.31-4ubuntu4.

Turning off IPv6 (leaving IPv4 on), on the Windows 10 machine stops the messages.

I am suffering from this too, there doesn’t even seem to be any way to suppress the syslog pollution.

richardm@GTS-TEST-SERVER:~$ avahi-daemon -V
avahi-daemon 0.6.30

richardm@GTS-TEST-SERVER:~$ uname -a
Linux GTS-TEST-SERVER 3.2.0-87-generic #125-Ubuntu SMP Fri Jun 19 08:25:10 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

tail -f /var/log/syslog
Aug 5 09:18:00 GTS-TEST-SERVER avahi-daemon[7787]: Registering new address record for 10.10.1.230 on eth0.IPv4.
Aug 5 09:18:00 GTS-TEST-SERVER avahi-daemon[7787]: Registering HINFO record with values 'X86_64'/'LINUX'.
Aug 5 09:18:00 GTS-TEST-SERVER avahi-daemon[7787]: Invalid response packet from host 10.10.1.108.
Aug 5 09:18:01 avahi-daemon[7787]: last message repeated 3 times
Aug 5 09:18:01 GTS-TEST-SERVER avahi-daemon[7787]: Server startup complete. Host name is GTS-TEST-SERVER.local. Local service cookie is 3631106496.
Aug 5 09:18:01 GTS-TEST-SERVER avahi-daemon[7787]: Invalid response packet from host 10.10.1.108.
Aug 5 09:18:02 avahi-daemon[7787]: last message repeated 4 times
Aug 5 09:18:02 GTS-TEST-SERVER avahi-daemon[7787]: Service "GTS-TEST-SERVER" (/services/udisks.service) successfully established.
Aug 5 09:18:02 GTS-TEST-SERVER avahi-daemon[7787]: Invalid response packet from host 10.10.1.108.
Aug 5 09:19:03 avahi-daemon[7787]: last message repeated 48 times
Aug 5 09:20:06 avahi-daemon[7787]: last message repeated 103 times
Aug 5 09:21:07 avahi-daemon[7787]: last message repeated 71 times
Aug 5 09:22:09 avahi-daemon[7787]: last message repeated 38 times
Aug 5 09:23:17 avahi-daemon[7787]: last message repeated 56 times
Aug 5 09:24:18 avahi-daemon[7787]: last message repeated 29 times

I tried contacting http://avahi.org on 28 Jul 2015 and have had no official response yet, and their webpage registering system is not working, so I cannot raise a ticket. However, a user on their mailing list has responded that there are people listening on the mailing list that may be able to help. Good to know.

still present in avahi-daemon 0.6.31 (ubuntu 15.04).

these messages are appearing in my syslog up to 12 times a second, presumably because there are a lot of Macs on my LAN.

Please apply the patch from comment #5 to the ubuntu package at least - it's literally a 2-line patch.

actually that patch isn't enough. even with just the line
  if (avahi_dns_packet_get_field(p, AVAHI_DNS_FIELD_ANCOUNT) == 0) {
as suggested, I still get this.

Perhaps newer versions of OS X do something that triggers this? Either way, I think we shouldn't spam people's log files.

Also seeing this on 14.04. This is on a large university network. Some comments above suggest that this is due to Macs, others suggest that this is perhaps due to Windows 10. Any further insights?
This pretty much makes my logs unusable.

I just put a script into /etc/cron.hourly/ that will copy the current syslog into a temporary file, filter out the pollution and cat it back to overwrite the original log file. Makes it usable again!

Im getting this on my Rasspberry Pi 2 also ... every few seconds ... v annoying
192.168.1.15 is a windows 10 box that is hosting a share im connected to using CIFS

Sep 14 07:41:22 pi-server avahi-daemon[2628]: Invalid response packet from host 192.168.1.15.
Sep 14 07:41:47 pi-server avahi-daemon[2628]: Invalid response packet from host 192.168.1.15.
Sep 14 07:41:51 pi-server avahi-daemon[2628]: Invalid response packet from host 192.168.1.15.

liked the idea of getting a script to run to clean it out
added this into a script file in /etc/cron.hourly

sed -i".bak" '/Invalid response packet from host/d' /var/log/syslog

seem to work well....just removes the lines directly from the syslog and creates a backup /var/log/syslog.bak

Ubuntu version: 14.04.2
error message:
avahi-daemon[2900]: Invalid response packet from host 192.168.1.61

from host with windows 10 (192.168.1.61)

Do your iptables ignore INVALID packets? Consider adding the following line to your ip6table:

-A INPUT -m state --state INVALID -j DROP

Add it at or near the end of the table...

Actually the iptables change won't hide the problem. I thought it had fixed our problem, but I was mistaken.

I'm seeing the same error on ubuntu 15.04 with avahi-daemon 0.6.31. There are up to 2 messages a second:

avahi-daemon[932]: Invalid response packet from host ........

Also affects me on ubuntu 15.04 with avahi-daemon 0.6.31 (up to 20 messages per second :-O)

This alternate issue tracker seems to be semi-official:
https://github.com/lathiat/avahi/issues/10

It has been fixed by the avahi guy, there is a 0.6.32-rc version.
Please update before wily release, this is really annoying, imagine having this released, any windows 10 machine will fill our logs...

AVAHI news on http://avahi.org/
2015-10-10: We have a release candidate, ​0.6.32-rc! This is mostly a bugfix release, see the ​Change Log. This is intended for release soon, please file any issues you notice through

Changelog:
Avahi 0.6.32-rc
===============

This is largely a bugfix release, non-bug changes are listed separately.

 * Don't log warnings about invalid packets, commonly triggered by Windows 10 systems
 * Fix issue with bad packet size estimation, causing probes to continuously be sent when hosting large numbers of services (Lee, Chun-Yi)
 * Fix build on Solaris/SmartOS (filio.h issue)
 * Fix build on FreeBSD (PCAP_D_IN issue)
 * Fix debug output with libdaemon >= 0.14
 * avahi_server_set_browse_domains now correctly uses the provided list, instead of re-using the list from the configuration file
 * Set nl_pid to 0, this will automatically assign the value and prevent conflicts per netlink(7). (Bug #334)
 * Check for netlink pid=0 (kernel) instead of uid=0, which works correctly with network & user namespaces.
 * Fix reversed IFA_LOCAL and IFA_ADDRESS checks. (Avahi#355)
 * Don't fail the build on deprecated GTK/GLIB usage
 * Gracefully fail if SO_REUSEPORT is not available
 * Minor Python 3 update for the python ServiceTypeDatabase test usage of print, should be backwards compatible

Changes

 * GTK3 deprecation fixes including vbox, g_object_unref on GdkCursor, stock items, composite API
 * New feature: host-name-from-machine-id= to configure the hostname from the machine-id, defaults to off.
 * Configuration change: Enable IPv6 by default (use-ipv6=yes)
 * Configuration change: Disable publishing HINFO and WORKSTATION records in the default config (publish-hinfo=no, publish-workstation=no)
 * Configuration change: Don't browse 0pointer.de and zeroconf.org wide-area by default (browse-domain=)

This release is backwards compatible with Avahi 0.6.x with x < 32.

I confirm that the patch in https://github.com/lathiat/avahi/issues/10 solves the problem and returns calm to our logs.

apt-get source libavahi-core7
cd avahi-0.6.31
change avahi-core/server.c according to patch
apt-get build-dep libavahi-core7
debuild -b -uc -us
cd ..
dpkg -i libavahi-core7_0.6.31-4ubuntu4_amd64.deb
systemctl restart avahi-daemon

Please include this in any future update. It is very annoying.

Instead of a cronjob or compiling the patch, you also could add a rsyslog-filter in /etc/rsyslog.conf:
# put this line before the line with *.*;auth,authpriv.none -/var/log/syslog
    :msg, contains, "Invalid response packet from host" stop
#then restart rsyslog to apply the settings
sudo service rsyslog restart

@xyzdragon (xyzdragon): Filtering in rsyslog does not work, you will hit imuxsock rate-limiting limit on networks with lot of windows machines:

rsyslogd-2177: imuxsock begins to drop messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock lost 51 messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock begins to drop messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock lost 24 messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock begins to drop messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock lost 78 messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock begins to drop messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock lost 110 messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock begins to drop messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock lost 10 messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock begins to drop messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock lost 10 messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock begins to drop messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock lost 161 messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock begins to drop messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock lost 169 messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock begins to drop messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock lost 79 messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock begins to drop messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock lost 17 messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock begins to drop messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock lost 125 messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock begins to drop messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock lost 24 messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock begins to drop messages from pid 2303 due to rate-limiting
rsyslogd-2177: imuxsock lost 23 messages from pid 2303 due to rate-limiting

It's out of context but can someone please provide the instructions to update to the 6.32 rc version. Thanks..

Still occurs on 15.10

Can confirm that this still has not been fixed in 15.10 Would appreciate some clearer instructions with patching to 6.32 as this is a real headache! :(

Here is upstream patch which fix this problem:
https://github.com/lathiat/avahi/commit/de7cde877e4daa5d9d4fb5b1a349299eaa94969d

One can install the 16.04 package that is 0.6.32 rc

basically (ensure your architecture is right)

wget http://launchpadlibrarian.net/227449619/libavahi-core7_0.6.32~rc%2Bdfsg-1ubuntu2_amd64.deb
sudo dpkg -i libavahi-core7_0.6.32~rc+dfsg-1ubuntu2_amd64.deb
sudo systemctl restart avahi-daemon

Proven to work for 15.10

Avahi has released version 0.6.32 today.
Full details and downloads at the link https://github.com/lathiat/avahi/releases/tag/v0.6.32

I did download and install the latest version 0.6.32 but I still see those warnings about the Invalid response packet.
For example with commands:

pi@raspberrypi:~ $ sudo service avahi-daemon status
● avahi-daemon.service - LSB: Avahi mDNS/DNS-SD Daemon
   Loaded: loaded (/etc/init.d/avahi-daemon)
   Active: active (running) since Wed 2016-03-23 00:14:41 EDT; 9h ago
  Process: 25630 ExecStop=/etc/init.d/avahi-daemon stop (code=exited, status=0/SUCCESS)
  Process: 25638 ExecStart=/etc/init.d/avahi-daemon start (code=exited, status=0/SUCCESS)
 Main PID: 16156 (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/avahi-daemon.service
           └─25644 avahi-daemon: running [raspberrypi.local]

Mar 23 09:11:07 raspberrypi avahi-daemon[25644]: Invalid response packet fro....
Mar 23 09:12:27 raspberrypi avahi-daemon[25644]: Invalid response packet fro....
Mar 23 09:13:08 raspberrypi avahi-daemon[25644]: Invalid response packet fro....
Mar 23 09:13:48 raspberrypi avahi-daemon[25644]: Invalid response packet fro....
Mar 23 09:14:28 raspberrypi avahi-daemon[25644]: Invalid response packet fro....
Mar 23 09:15:08 raspberrypi avahi-daemon[25644]: Invalid response packet fro....
Mar 23 09:15:48 raspberrypi avahi-daemon[25644]: Invalid response packet fro....
Mar 23 09:16:29 raspberrypi avahi-daemon[25644]: Invalid response packet fro....
Mar 23 09:17:09 raspberrypi avahi-daemon[25644]: Invalid response packet fro....
Mar 23 09:17:49 raspberrypi avahi-daemon[25644]: Invalid response packet fro....
Hint: Some lines were ellipsized, use -l to show in full.
pi@raspberrypi:~ $ sudo avahi-daemon --version
avahi-daemon 0.6.32

I did struggle with the new compile and install though since I am new to the Linux system. Is there anything I may have missed or done wrong?

How did you install avahi?

Can you run this:

sudo which avahi-daemon
sudo dpkg -l avahi-daemon

Actually that might happen if you don't have a newer libdaemon (they made some changes to default log levels), I'll have to check on that.

Hi - thanks for response! I have become quite set (read obsessed) on fixing this even though I only see the error every 40secs and I filter blocked it out from polluting my syslog file.

I installed from the avahi-0.6.32.tar.gz using :
./configure
make
sudo make install

also make clean (between recompiles)

pi@raspberrypi:~ $ sudo which avahi-daemon
/usr/local/sbin/avahi-daemon
pi@raspberrypi:~ $ sudo dpkg -l avahi-daemon
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-==============-============-============-=================================
rc avahi-daemon 0.6.31-5 armhf Avahi mDNS/DNS-SD daemon

Also, stranger still, is that I totally commented out the suspected offending log line in the server.c file and recompiled the project - so this could be more about my lack of compiling skills than avahi issue??

            /*avahi_log_debug("Invalid response packet from host %s.", avahi_address_snprint(t, sizeof(t), src_address)); */

Forgot to address the libdaemon question:

pi@raspberrypi:~ $ sudo apt-show-versions -r libdaemon
libdaemon-dev:armhf/jessie 0.14-6 uptodate
libdaemon0:armhf/jessie 0.14-6 uptodate

Thanks again!

Most likely your issue is that the system init scripts are starting the packaged binary from /usr/sbin/avahi-daemon instead of your compiled binary from /usr/local/sbin/avahi-daemon

I am going to build and propose an SRU to precise & trusty to fix this issue.

For Debian Jessie on your rpi, you'll need to file a bug at bugs.debian.org (though I think there already is one)

I thought this may be occurring but I deleted the original "old" 0.6.31 version file in /usr/sbin/avahi-daemon and replaced it with the newer one I compiled from 0.6.32 and also left another copy in /usr/local/sbin/avahi-daemon. So when I search my files for avahi-daemon only 2 copies of the newer one show up.

Oh and I did check and there seems to be a similar bug report field already in bugs.debian.org against the version 0.6.32~rc+dfsg-1 on the i386 platform:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=805379

On Thursday 24 March 2016 02:14:56 Trent Lloyd wrote:
> I am going to build and propose an SRU to precise & trusty to fix this
> issue.

Hi! Any update on this? Updated avahi packages in precise & trusty
repositories should fix this problem...

Hello,

I am affected by this bug on Ubuntu 14.04. I am working in a scientific institute with almost a thousand computers. I received 48 millions entries in syslog the last 48 hours, making a 4.4GB file :/

Attaching debdiff for sponsorship into trusty. Applies upstream commit (by myself) to fix this issue.

Not required in xenial, but could be uploaded into wily.

Also uploaded and built the package here, so people can test it out if they want. Would love feedback from someone with the issue to confirm it fixes it:
https://launchpad.net/~lathiat/+archive/ubuntu/lp1342400-avahi-invalid-response-packet

@lathiat - I've been running the package since this morning. Normally get "...Invalid response packet from host..." messages logged every ~20 seconds into syslog, but since updating to the patched package, I haven't seen a single error logged.

This is on Ubuntu 14.04.4.

Also affects LTS precise release. Can you upload also fix for precise?

Xenial and Yakkety already have this fix.

Uploaded to trusty SRU review queue with fixed LP bug ref in the changelog, thanks!

Hello Steve, or anyone else affected,

Accepted avahi into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/avahi/0.6.31-4ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Steve, or anyone else affected,

Accepted avahi into precise-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/avahi/0.6.30-5ubuntu2.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Ubuntu precise version working, verified.

This bug was fixed in the package avahi - 0.6.30-5ubuntu2.2

---------------
avahi (0.6.30-5ubuntu2.2) precise; urgency=medium

  * debian/patches/lp-1342400-invalid-response-packet.patch:
    - Stop printing "Invalid response packet" messages to system log, they can
      occur frequently filling the logs from some mDNS stacks. Patch from
      upstream commit de7cde877e4daa5d9d4fb5b1a349299eaa94969d (LP: #1342400)

 -- Trent Lloyd <email address hidden> Fri, 10 Jun 2016 07:12:31 +0000

The verification of the Stable Release Update for avahi has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

This still needs to be tested on trusty, adjusting tags.

Tested on trusty amd64, extraneous syslog messages have disappeared.

As there is no rollup package in trusty to fetch everything, I had to install the following packages from trusty-proposed

All are version 0.6.31-4ubuntu1.1_amd64

avahi-daemon/trusty-proposed
avahi-utils/trusty-proposed
avahi-autoipd/trusty-proposed

<Just installing the above doesn't do the trick. The libs are needed, or at least some of them>

libavahi-core7/trusty-proposed
libavahi-client3/trusty-proposed
libavahi-common-data/trusty-proposed
libavahi-common3/trusty-proposed
libavahi-glib1/trusty-proposed
libavahi-gobject0/trusty-proposed

This bug was fixed in the package avahi - 0.6.31-4ubuntu1.1

---------------
avahi (0.6.31-4ubuntu1.1) trusty; urgency=medium

  * debian/patches/lp-1342400-invalid-response-packet.patch:
    - Stop printing "Invalid response packet" messages to system log, they can
      occur frequently filling the logs from some mDNS stacks. Patch from
      upstream commit de7cde877e4daa5d9d4fb5b1a349299eaa94969d (LP: #1342400)

 -- Trent Lloyd <email address hidden> Fri, 10 Jun 2016 07:12:31 +0000