1

I have GlassWire installed on my PC in order to monitor incoming and outgoing network connections, and I also use a VPN regularly (these 2 details seem irrelevant but will become useful later),

Very often, regardless of what I may be doing at the time, I notice in GlassWire that NT Kernel & System is contacting (uploading data but not getting response back) to various local and non-local IP addresses, such as 10.0.0.5 (my phone), 10.0.0.3 (my computer's IP on my home LAN), 10.8.0.136 (my computer's IP on the VPN LAN) as well as multicast IPs (224.0.0.252).

It also makes some connections to some public IP addresses owned by Microsoft and Google, but what concerned me most was that I noticed that most of the non local IP addresses it was making connections to were the IP addresses of VPN servers that I had connected to myself earlier in the same day or even the previous day.

Sometimes I can see it's made a connection to seemingly every single one of the some 300 VPN servers my provider has.

Why is it making these connections, I am curious, why is NT Kernel & System querying the IP addresses of VPN servers that I have connected to in the past? Does anyone know the actual purpose of the "NT Kernel & System" , I'm wondering if this is some telemetry function or less likely, malicious events? I am concerned with it contacting all these IP addresses and I hope it's not logging them somewhere.

I would be appreciative if someone more knowledgeable than myself on the function of this program could inform me please.

harrymc
  • 498,455
Computer_User
  • 97

1 Answers1

0

What you are seeing is normal behavior for network discovery, full name Simple Service Discovery Protocol.

Since the VPN creates a network, which in most aspects behaves just the same as a local network, Windows is periodically issuing discovery messages on the network for verifying the status of all the other computers that it knows about, as well as finding new computers, devices and services.

The 224.0.0.252 IP address that you see is the Link-Local Multicast Name Resolution, by which network discovery is achieved.

harrymc
  • 498,455