we have one computer in ours network that constantly send to dns requests. I see this in Fortigate forward traffic log and the user of that computer have to solve reCAPTCHA a few times in hour when he use google search. This computer is a notebook with two network card, one is usually connected to ethernet LAN (fortigate) and wi-fi network card is usually connected in the same time to guest network from other SOHO router (with is send through DHCP as main DNS).

My question is how to find with app/process on that computer send this unusually DNS request to


So I do some checks. The case is definitely related with enabled and connected wi-fi network card. When I change SOHO router DHCP configuration to send different DNS configuration (not but DNS server of my local internet service provider) in Fortigate forward trafic log there are now entries with source of ethernet IP address(and MAC) and destination to DNS server of my local internet service provider.

It is look like some process/app take DNS configuration from wi-fi and send request through ethernet.

Sysmon doesn' t show any unusually dns query. Any ideas?

2 Answers 2


If the app/process is constantly running you could use the following:

netstat -tapvln | grep

It will need to be run as root because the -p flag means show the process ID.

If its not constantly running, you could put the watch command before it and monitor until you find the culprit.

watch netstat -tapvln | grep

Microsoft Sysmon has DNS logging.


It can be enabled using a configuration file.


<Sysmon schemaversion="4.21">
  <DnsQuery onmatch="exclude" />

To install:

sysmon.exe -accepteula -i sysmon.xml

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .