Determine cause of connection?

[Morasithil]

What would you like to add or change?:
Windows 10 21H2 immediately after boot svchost.exe (systemdnsclient) made a request to google-analytics.com
Can i find out what exactly caused this connection attempt?

Why do you and others need this?:

[dhaavi]

Hey @Morasithil,

The screenshot clearly shows that you are looking at the "System DNS Client", and well, it does just that. It is the DNS client from Windows, which resolved DNS queries on behalf of applications.

So, something on your device wanted to connect to google-analytics.com. That is all we can know at this point.

Have you changed any settings of System DNS Client?
Normally, it should resolve it and then Portmaster sees which process is actually trying to connect.

[Morasithil]

Hey @Morasithil,

The screenshot clearly shows that you are looking at the "System DNS Client", and well, it does just that. It is the DNS client from Windows, which resolved DNS queries on behalf of applications.

So, something on your device wanted to connect to google-analytics.com. That is all we can know at this point.

Have you changed any settings of System DNS Client? Normally, it should resolve it and then Portmaster sees which process is actually trying to connect.

Thanks for the reply.
I know that the system dns client shows connections of all applications.
I've manually added google domains to the blocklist, if it wasn't already in the bigtech filterlist that i've also activated.

The connection attempt is suspicious because i saw it after a fresh reboot without launching any programs other than portmaster so i wanted to know which application is responsible for the google analytics request, svchost.exe doesn't really say much.

[Raphty]

So from what I am seeing you probably did change the system dns specific setting.

What Daniel was trying to explain was, that if you change the setting there, then you never see what process wanted to connect to this domain, because it gets blocked before the actual responsible process tries to connect.

So pleas revert this setting back to default, (you can also delete it, and it will get rebuilt, there even is a note in there, instructing you to do so if you mess with the app settings 😄 )

[Morasithil]

Yes i understod what dhaavi was saying, just didn't want to unlock google for obvious reasons.
Unlocking google means google will be able to establish a connection to my device and i have no idea what data will be exchanged.
However unblocking google would also allow me to identify the app actually responsible for the connection.
I'll ignore this for now unless it happens again.
Thank you.

[Raphty]

there is no data connection, that is the dns request. and it is not going to google, it is going to the configured DNS server. And the Data connection comes after and that will get blocked, but to know what program wants to establish the data connection you need to allow the DNS request first.