Windows 10 telemetry network traffic analysis, part 1

VOAT ^ | 2/3/2016 | "CheesusCrust"

[Dalberg-Acton]

"Like many of you, I am concerned about the telemetry, spying and other surveillance features, known or unknown, of Windows 10. It has concerned me enough to push me to Linux Mint as my main operating system. Even so, I wanted to better understand Windows 10, but internet search results for a decent windows 10 traffic analysis leave a lot to be desired. As such, I decided to do my own investigating on what, exactly, Windows 10 is doing traffic-wise, and post the results. For this analysis, I wanted to simply analyse the network traffic of Windows 10 on a clean install, and just let it sit and run without using it."

[Gideon7]

On VS2015 you can download the online MSDN help libraries and view them locally without an Internet connection. The download is hefty (gigabytes) but you only need to do it once.

Or use PackageThis to download a subset of the MSDN help tree and create your own local mini-help library.

[tazman3]

Bookmark

[dayglored]

Windows 10 telemetry network traffic analysis... PING!

You can find all the Windows Ping list threads with FR search: just search on keyword "windowspinglist".

Thanks to Dalberg-Acton for the ping!!

[The Antiyuppie]

“...adobe did the same dang thing- forcing users who wanted to upgrade into a monthly payment...”

This is modern business thinking. Annuities are MUCH more desirable because they are steady, predictable income and it’s easier to keep customers. It isn’t “Sell a lot of what we have and hope that we can stretch the money in order to pay for the development of the next version”. You now see this thinking in many “industries”, even in selling coffee (the Keurig’s).

[rarestia]

Thank you for the honest assessment, msgt. I’ve not taken any time to analyze my network FW logs to determine traffic concerns with my Win10 VM. I turned off all telemetry and updates, put the VM on a VLAN all by itself, and I watched the traffic logs. Over the course of 24 hours, a total of 60 MB of data went back and forth, and most of that was broadcast traffic (e.g. router advertisement).

If they’re using OOBE in the test, you’re essentially setting the OS back to factory.

Take the hint: if they start the article with something mentioning Linux, they’re not in the business of giving anything Redmond a fair crack.

[miliantnutcase]

Windows 7 does it too... Just not to the extent of 10.

[Still Thinking]

Could you build fake, benign replacements for those libraries with they same call interface, so the crap will still build, but you KNOW it’s not doing anything nefarious?

[Bob434]

[[You now see this thinking in many “industries”, even in selling coffee (the Keurig’s).]]

True, but you also see many people like myself who will have nothing to do with such models- I will not buy a vehicle In the future which the company claims ‘isn’t mine’ and who charges me way more after all the mandatory monthly payments are made compared to buying outright and owning the vehicle myself- (Not saying automakers will go to such a model- but it’s a useful analogy- and there actually has been talk by some claiming we don’t actually own the vehicles we purchase)

Anyway- IF MS goes to this kind of model, I will move to Linux and keep windows 7 in a virtual machine -

[CodeToad]

Just load up the network engineer’s favorite tool: WireShark. It reports on all network traffic in and out of the computer. It gives 100% of all data, including the data packets and where the data is going or coming from.

[CodeToad]

Windows 7 64-bit sends nothing that I can find.

[Dalberg-Acton]

That’s good news. Thanks for taking the time to investigate.