Comment by gcampos

That is correct! There is no annotation of which apps a packet comes from, so VineWall also runs locally a DNS proxy and uses the domain to infer the app