Pi-Hole localhost spams requests to google-analytics.com - how to identify sender?

[mx2k]

Expected Behaviour:

Pi-Hole localhost does not use any tracking websites.

Actual Behaviour:

See screenshot. I have only installed Pi-Hole 5.1.1 and PiVPN on my RasPi 3. Since the update to Pi-Hole 5.x it started blocking requests from localhost to google-analytics.com.

It really spams my statistics so I had to exclude localhost and google-analytics.com from the top 10 host/domain lists in dashboard.

PLEASE LET ME KNOW HOW TO IDENTIFY WHICH PIECE OF TRASH SOFTWARE IS SENDING REQUESTS TO google-analytics.com FROM THE DEVICE WHICH IS BLOCKING THOSE REQUESTS.

[yubiuser]

I'm not familiar with PiVPN but if you use this VPN to connect to your RapPi3 and send DNS requests via the tunnel to pihole they might appear to come from localhost. To figure it out, disable/disconnect any clients from PiVPN and see if the requests disappear.

[mx2k]

Hello, nope that is not the case.
Connections via PiVPN show up in Pi-Hole hostname stats as user1.pivpn, user2.pivpn etc

Furter, not sure if relevant, but those connections started to appear after updating PiHole from version 4.x to 5.x. On v4.x there never was a single connection to google from localhost

Basically I need some Linux tool that identifies which process on localhost is sending those requests.

[yubiuser]

Ok, would be a too easy solution

Have a look here:

How to find out PID of the process sending packets (generating network traffic)?

or

How can I identify which processes are generating UDP traffic on Linux?

[mx2k]

Thanks for those tutorials, they help me with other issues

I have found the perp, it was netdata. It auto-updated to a version which includes usage tracking via google analytics.

In case anyone else runs into this issue, here's how to opt out netdata/docs/anonymous-statistics.md at c4ec0791bf2944cd32093c51b622c9ff583ce82f · netdata/netdata · GitHub