Wireshark pcap file - figuring out external dns

Question

I'm new to security and was working on a problem where I need to figure out the external DNS used to resolve names to IP. I can filter how to look for dns traffic but how do I figure out the external DNS used to resolve addresses?

Answer 1

There can be several DNS resolvers used. If you know they all listen on standard port UDP/53, you can simply retrieve the destination IP addresses:

$ tshark -r tmp.pcap -T fields -e ip.dst "udp.dstport eq 53" | sort | uniq -c
31 127.0.0.1
3 192.168.1.3

The above will give you the list of destination IP addresses for UDP/53 packets. In my case, I have a local resolver (127.0.0.1) which only calls the above resolver (192.168.1.13) for records that are not cached. Thus, most requests only go to the local resolver (31 out of 34).

---

It's also fairly common for DNS resolvers to listen on TCP/53. You can use the following command to select these requests as well:

tshark -r capture.pcap -T fields -e ip.dst "udp.dstport eq 53 or tcp.dstport eq 53" | sort | uniq -c

You can also apply filter packets while capturing, to avoid saving unnecessary packets:

tshark -i any -T fields -e ip.dst "dst port 53" > capture.txt
cat capture.txt | sort | uniq -c