I was looking at the dnsmasq logs on a router I run and noticed that there are requests to a particular url on a regular basis. This was happening while the only client connected to the network was my laptop, and I didn't have my browser or any other client programs open. How can I figure out what process is responsible for these queries?


I would suggest installing Wireshark (https://www.wireshark.org/) on the laptop. That should allow you to show all packets going in and out of the system and the process responsible for them. That should give you a good place to start, once you know the process running I would suggest killing it via the command line and confirming that the traffic to the router has ceased.

Once that has been done you can do further investigation into the process to see if it is a rogue process etc.

If you post back here with the information you find I'll be happy to help further.

  • It seems like the dns queries are going out on transient high ports so by the time I netstat the port is already out of use meaning I can't figure out which process had it. Is there any streaming version of netstat or something similar? – Davis Yoshida Nov 17 '14 at 22:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.