Label com.apple.mDNSResponder.mdns-tcpdump ProgramArguments /usr/sbin/tcpdump -w /tmp/mdns-tcpdump.pcapng -C 10 -W 16 ( udp port 5353 ) or arp or icmp or icmp6 KeepAlive