Use Fiddler to determine which connections Windows 10 establishes automatically

A lot has been found out about the data collection that is going on in Microsoft’s new operating system Windows 10.

We have covered these issues in our Windows 10 privacy guide, but it became clear quickly that Windows was still phoning home at times even when you disable or block all options provided under settings and elsewhere.

Most users are probably unaware of this since it all happens in the background. You can check out Ars Technica’s findings on the matter which provide you with details about network activity after turning off or disabling phone-home features such as Cortana or Web Search.

But what if you want to find out about that on your own? The following guide provides you with information on how to set up your own network monitor to get a detailed account on what is happening in the background when you are using your computer and when your computer is idle.

mod apk

It works well for all kind of tasks, not only to monitor the operating system level but also applications or apps.

Note: Fiddler may not catch all network traffic even if you configure it to capture http and https traffic. As Ars Technica notes, Windows appears to use a content deliver network that bypasses network monitors.

It is recommended to run the program in a virtual machine as it needs to install a root certificate on the system in order to capture https traffic. While you can install the certificate on the underlying system as well, it is not recommended. If you still want to go ahead, make sure you remove it once you are done.

You need to download Fiddler4 from the developer website and install it afterwards. Start the program, and select Tools > Fiddler Options.

Switch to HTTPS and check the “Decrypt HTTPS traffic” box. Make sure all processes are listed and click ok. Fiddler displays its root certificate warning prompt which you need to accept to continue.

fiddler https

A security warning is displayed afterwards which you need to accept as well. You need to accept the User Account Control prompt as well to complete the process, and then that you “really” want to add the certificate.

Once you are back in the main interface select Stream in the main toolbar so that it is highlighted with a rectangular box around it.

Make sure capturing is listed in the lower left corner.

fiddler web debugger

This is all to it and you should see network traffic being listed in the interface when it occurs. A simple example of this is the ping to when you use the search, even if you have disabled web search previously.

As soon as you start typing the first character in the search form, a ping to is sent by the operating system.

Remove the root certificate

root certificates

To remove the root certificate again, do the following:

  1. Tap on the Windows-key and type Certificate.
  2. Select “Manage user certificates” from the list of results.
  3. Open Trusted Root Certification Authorities > Certificates.
  4. Locate all (should be two) DO_NOT_TRUST_FiddlerRoot certificates.
  5. Select them and hit the delete key on the keyboard.
  6. Select yes when the prompt is displayed to remove it from the system.


Article Name

Use Fiddler to determine which connections Windows 10 establishes automatically


Martin Brinkmann


Find out how to set up a network monitoring environment on Windows 10 to detect when the operating system phones home.

About Martin Brinkmann

Martin Brinkmann is a journalist from Germany who founded Ghacks Technology News Back in 2005. He is passionate about all things tech and knows the Internet and computers like the back of his hand. You can follow Martin on Facebook, Twitter or Google+

You are here: Home > Windows > Use Fiddler to determine which connections Windows 10 establishes automatically

This entry passed through the Full-Text RSS service – if this is your content and you’re reading it on someone else’s site, please read the FAQ at