2

So I've been using pihole and my Android 7 phone is making some unexpected requests to DNS for a particular domain. Is there an app or technique I can use to find which app is initiating those request. It seems the Java level DNS cache won't have that info.

I'd guess one needs to intercept requests to the phones DNS service (*), recording the requested domain and the requesting app; are their hooks in Android to do that?

I don't have root. Any help appreciated.

(* - yes I know what this acronym means!)

|improve this question
  • 1
    If you have root, you can install a DNS server like dnscrypt-proxy to view/block all DNS requests. It can be combined with iptables owner module to find out which requests are made by which app. – Irfan Latif Feb 16 '19 at 13:55
  • I'll look at getting root but I'm not sure a safe root is available on my device (Honor 5C, NEM-L51 by Huawei). Thanks for the tip, FWIW I've heard OS Monitor app is useful for tracking such things but it doesn't work on Android7 and up. – pbhj Feb 17 '19 at 14:14
  • With root you could extract all the APKs (plus app private data) from your device unzip them and make a grep over all the data. If you are lucky you will find the DNS name and therefore know the app. – Robert Feb 17 '19 at 15:03
  • Nice idea, could extract suspect apps dl-ed from app store, grep through them, might find something. – pbhj Feb 17 '19 at 21:45
-1

Try Net Monitor! It shows network connections of installed apps.

|improve this answer
  • What is your connection to the app you've recommended? Developer, or your company, or any other thing to disclose? – wbogacz Mar 23 '19 at 0:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.