Wireshark/DNS

Wireshark is a free and open source packet analyzer used for network troubleshooting and analysis. These activities will show you how to use Wireshark to capture and analyze Domain Name System (DNS) traffic.

Readings

Wikipedia: Domain Name System

Multimedia

YouTube: Wireshark 101: The Domain Name System, HakTip 129

Preparation

To prepare for this activity:

Start Windows.
Log in if necessary.
Install Wireshark.

Activity 1 - Capture DNS Traffic

To capture DNS traffic:

Start a Wireshark capture.
Open a command prompt.
Type ipconfig /flushdns and press Enter to clear the DNS cache.
Type ipconfig /displaydns and press Enter to display the DNS cache.
Observe the results. Notice the only records currently displayed come from the hosts file.
Type nslookup en.wikiversity.org and press Enter.
Observe the results. Notice there is an entry in the cache for en.wikiversity.org.
Close the command prompt.
Stop the Wireshark capture.

Activity 2 - Analyze DNS Query Traffic

To analyze DNS query traffic:

Observe the traffic captured in the top Wireshark packet list pane. To view only DNS traffic, type udp.port == 53 (lower case) in the Filter box and press Enter.
Select the DNS packet labeled Standard query A en.wikiversity.org.
Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 4 / User Datagram Protocol / Domain Name System (query) frame.
Expand Ethernet II to view Ethernet details.
Observe the Destination and Source fields. The destination should be either your local DNS server's MAC address or your default gateway's MAC address and the source should be your MAC address. You can use ipconfig /all and arp -a to confirm.
Expand Internet Protocol Version 4 to view IP details.
Observe the Source address. Notice that the source address is your IP address.
Observe the Destination address. Notice that the destination address is the IP address of the DNS server.
Expand User Datagram Protocol to view UDP details.
Observe the Source port. Notice that it is a dynamic port selected for this DNS query.
Observe the Destination port. Notice that it is domain (53), the DNS server port.
Expand Domain Name System (query) to view DNS details.
Expand Flags to view flags details.
Observe the Recursion desired field. Notice that a recursive query is requested.
Expand Queries to view query details.
Observe the query for en.wikiversity.org.

Activity 3 - Analyze DNS Response Traffic

To analyze DNS response traffic:

In the top Wireshark packet list pane, select the next DNS packet, labeled Standard query response CNAME wikiversity....
Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 4 / User Datagram Protocol / Domain Name System (response) frame.
Expand Ethernet II to view Ethernet details.
Observe the Destination and Source fields. The destination should be your MAC address and the source should be your local DNS server's MAC address or your default gateway's MAC address.
Expand Internet Protocol Version 4 to view IP details.
Observe the Source address. Notice that the source address is the DNS server IP address.
Observe the Destination address. Notice that the destination address is your IP address.
Expand User Datagram Protocol to view UDP details.
Observe the Source port. Notice that it is domain (53), the DNS server port.
Observe the Destination port. Notice that it is the same dynamic port used to make the DNS query in the first packet.
Expand Domain Name System (query) to view DNS details.
Expand Flags to view flags details.
Observe the flags. Notice that this is a recursive response.
Expand Queries to view query details.
Observe the query for en.wikiversity.org.
Expand Answers to view answer details.
Observe the CNAME and A records returned in response to this DNS query.
Close Wireshark to complete this activity. Quit without Saving to discard the captured traffic.