7.2 KiB
source_url, ingested, sha256, discovered_from
| source_url | ingested | sha256 | discovered_from | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| https://www.howtogeek.com/claude-read-my-dns-log/ | 2026-07-02 | 80579f61e4e8005951c765237aa65199776e06402760abdd8690c7d8fb88ef55 |
|
I run Pi-hole on my network to help block unwanted ads and trackers. Pi-hole logs all of the DNS requests made by devices on my home network. There are hundreds of thousands of queries to thousands of domains, so I let Claude take a look at the log to see what it could find.
My smart home is louder than I thought
Credit: Bertel King / How-To Geek
I didn't want to bog Claude down in a huge amount of data, so I exported the logs for the past four days and uploaded them to Claude. I asked it to take a look and see if it could find any patterns or anything interesting or unusual.
The first thing that Claude uncovered was that my smart home was responsible for a serious chunk of my network's DNS traffic. I run Home Assistant in Proxmox on a mini PC and I have a fairly typical smart home setup with multiple smart home devices and sensors. I have plenty of other connected devices around my home, and I assumed the traffic would be fairly evenly spread.
I was quite surprised that Claude determined that of nearly 400,000 queries across the four days, nearly 85,000 were from Home Assistant. This was more than 20% of requests across the network.
A large chunk of these were requests that weren't seeking the IP address for a specific domain at all. These are often basic connectivity requests, DNS resolver health checks, or VPN or tunnel software. Claude didn't think that any of these requests were concerning but it was surprised by how much traffic was coming from Home Assistant.
Home Assistant Green is a pre-built hub directly from the Home Assistant team. It's a plug-and-play solution that comes with everything you need to set up Home Assistant in your home without needing to install the software yourself.
My washing machine is calling Tokyo every 72 seconds
It's not even that smart
Credit: Adam Davidson / How-To Geek
This one was a real revelation to me. I have a Samsung washing machine that has some basic smart features that let me start, pause, or monitor the washing machine from my phone. I tried using it with Home Assistant, but it relied on the SmartThings integration, which is cloud-based rather than local, so I ended up removing it as there are other ways to track when the cycle is completed.
I'd forgotten about its smart features, but Claude unearthed that the washing machine wasn't just phoning home, it was doing it virtually non-stop. Pi-hole logged almost 5,000 DNS requests across four days for hostnames that resolved to cloud servers hosted in Tokyo. That worked out to a DNS lookup roughly every 72 seconds, around the clock.
Claude told me that it had found reports from other users of Samsung devices who had found similar results. This isn't unique to my washing machine, but it's something I had been completely unaware of.
My phone was busier than I expected
There's a lot of logging happening in the background
Credit: Lucas Gouveia / How-To Geek
I was expecting a lot of traffic to be related to my phone use, but what Claude uncovered surprised me. It wasn't the amount of traffic that was unexpected, but the types of queries that were coming from my phone.
Out of almost 75,000 queries from my phone during the four-day window, more than 10,000 of them went to analytics and ad tracking services, including Google Firebase logging, Google Tag Manager, and other tracking SDKs. What surprised me was the number of requests to Facebook domains, because I don't have Facebook installed on my phone and I don't use it in the browser.
Claude suggested that many of these requests were likely to be coming from WhatsAp p, since it runs on Meta's shared infrastructure and is the only Meta app on my phone. However, without inspecting network traffic on the phone itself, it's impossible to know for certain which app generated each request. It's a reminder that a domain name in Pi-hole doesn't always tell you exactly which app is responsible.
My Echo Show isn't even trying to hide ad and tracking requests
A fifth of traffic was to these services
Claude was highly amused by how brazen Amazon's tracking was on my Echo devices. Out of 23,000 requests, more than 4,500 of them went to a single domain named trck.ahs.prod-eu.turntable.sonic.advertising.amazon.dev. Claude found it hilarious that the ad and tracking domain had "advertising" right in the domain name.
Despite using the Echo devices for things such as playing music during the four-day window, a fifth of the DNS requests were to this advertising and tracking domain. It's impossible to say for certain, but it seems likely that some of these calls are responsible for the seemingly endless number of unwanted ads. Learning this only gives me more impetus to repurpose all of my Alexa devices or disconnect them from the internet.
Claude is great for analyzing raw data
With hundreds of thousands of DNS requests over the four-day period, wading through this data on my own would have been a thankless task. Pi-hole's dashboard is useful, but it's not always easy to see the forest for the trees. Handing the data to Claude turned a list of cryptic hostnames into the story of what's really happening on my local network.