Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Tracking Process ID in DNS queries using WFP driver

LearnerLearner Member Posts: 7

I am trying to block dns requests, using WFP driver. I am checking DNS port 53, I am able to get all DNS requests. I wanted to know exact process that has initiated DNS request, for chrome.exe, nslookup I am able to get exact process ID. but for some processes msedge, ping I am not able to get exact process ID, instead I am getting svchost (dnsclient service) PID.
Any workaround how I can get the exact process Id that initiated DNS query?

Thanks in Advance

Comments

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,678

    The DnsQuery APIs use a DNS cache maintained by the DNS Client service. If you disable that service you'll see the actual requesting process but you'll also disable the DNS cache.

    -scott
    OSR

  • MBond2MBond2 Member Posts: 707

    IIRC this is not generally possible. If a UM program hand crafts DNS query UDP packets, and opens a socket to send them on, then sure. But I don't know of any program that does this. Instead they rely on the name resolution APIs provided by the OS - getaddrinfo etc. Those APIs will use some mechanism, possibly DNS, to resolve the name. Even in 2024 it could be a local hosts file or WINS or NetBIOS PROBE rather than DNS.

    Then you have the problem that programs like Edge don't run in a single process like 'normal' programs. But that's a much larger problem

    Perhaps if you explain what you are trying to do with this information, we might be able to help more

  • LearnerLearner Member Posts: 7

    @Scott_Noone_(OSR) @MBond2 thank you so much for repsonse.

    I am trying to allow/block some of the dns queries based on process name/process id.

    Thanks

  • MBond2MBond2 Member Posts: 707

    with that very simple statement of what you are trying to do, I can give the very simple answer - you can't do that. If you can explain a larger problem you are working on, we might be able to help more

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 13-17 May 2024 Live, Online
Developing Minifilters 1-5 Apr 2024 Live, Online
Internals & Software Drivers 11-15 Mar 2024 Live, Online
Writing WDF Drivers 20-24 May 2024 Live, Online