title: Map DNS query to process id
body: <p>I am looking to map a DNS query from a Windows system to a process ID.
  I found only one solution so far, but it is "bittersweet".</p>
  
  <p>I have this local DNS server that intercepts DNS queries and forwards them to the real server. That means I listen on 127.0.0.1:53 on both UDP and TCP (UDP mostly).
  When I get a DNS query, I have the client's port and track it down with netstat, therefore I can see the process ID who made that query.</p>
  
  <p>The problem here is, I get only the pid of Chrome.exe and svchost.exe.
  That is because Chrome probably has its own DNS resolver, where all the other apps use the default Windows resolver which is probably in svchost.exe.
  If I create a simple console application and make an HTTP request to let's say 'Stack Overflow.com', I'll get a DNS request from svchost.exe.
  I need to get the pid of 'consoleapplication1.exe' instead.</p>
  
  <p>I tried using netstat to see the IPs the process connects to, and then correlate them with the resolved answer of that DNS query, but that doesn't work for me.
  Why? Because I am using this local DNS server to block certain queries. So for example, if I want to block "abc.com", that process will never connect to "abc.com"'s IP, because I'm blocking it from the DNS server.</p>
  
  <p>I only need to find the process to what I'm blocking.</p>