Menu
I am new to wireshark and trying to write simple queries. To see the dns queries that are only sent from my computer or received by my computer, i tried the following:
dns and ip.addr==159.25.78.7
where 159.25.78.7 is my ip address. It looks like i did it when i look at the filter results but i wanted to be sure about that. Does that filter really do what i am trying to find out? I doubted a little bit because in the filter results i also see only 1 other result whose protocol is ICMP and its info says "Destination unreachable (Port unreachable)".
Can anyone help me with this?
Thanks
658
To analyze DNS query traffic: Observe the traffic captured in the top Wireshark packet list pane. To view only DNS traffic, type udp. port == 53 (lower case) in the Filter box and press Enter.
Get the ip address of the webserver (e.g. 'ping www.wireshark.org') and use the display filter 'ip. addr==looked-up-ip-address' or. Use the filter 'http. host==www.wireshark.com' to get the POST/GET request followed by 'Follow TCP stream' to get the complete TCP session.
DNS trace (dig + trace) If there is a problem, you will see exactly where it is. First, you request a webpage, for example, www.cloudns.net. The query gets to the root name server for it. This name server will show you the TLD authoritative server.
Wireshark supports limiting the packet capture to packets that match a capture filter. Wireshark capture filters are written in libpcap filter language. Below is a brief overview of the libpcap filter language's syntax.
I would go through the packet capture and see if there are any records that I know I should be seeing to validate that the filter is working properly and to assuage any doubts.
That said, please try the following filter and see if you're getting the entries that you think you should be getting:
dns and (ip.dst==159.25.78.7 or ip.src==159.57.78.7)
This filter will show only DNS traffic from 159.57.78.7 or to 159.25.78.7.
175
Rather than using a DisplayFilter you could use a very simple CaptureFilter like
port 53
See the "Capture only DNS (port 53) traffic" example on the CaptureFilters wiki.
11
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
