0

I want to launch a HTTP request to a website I've never visited before. I would like to pick up all of the packets related to this request; so DNS packets, TCP packets, et cetera.

Is there a way to pick up all of these? I have found that I can filter by the website's IP address, but this does not give me the DNS packets. How can I get all related packets?

  • DNS doesn't go to the HTTP server, but to the DNS server. If you capture all packets, you will get the DNS packets, too. – Ron Maupin Feb 6 '17 at 4:59
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 14 '17 at 4:34
1

Try this:

(ip.addr==192.0.2.4) and (http or dns)

192.0.2.4 is your PC's address.

EDIT: You could include the addresses of your DNS server and the website

(ip.addr==<nameserver> and DNS) or (ip.addr==<website> and http)
  • I want to exclude all of the packets that were not a part of this transaction. Is there any way to do that? – Daniel Paczuski Bak Feb 6 '17 at 18:40
  • I suppose you could include the addresses of your DNS server and the website (ip.addr==<nameserver> and DNS) or (ip.addr==<website> and http) – Ron Trunk Feb 6 '17 at 18:47
0

I believe you will have more luck first using the web developer part of firefox of equivalent. Because one request to a website as seen from the user perspective may mean a lot of network trafic on various other websites, to load images, scripts, CSS and such. So filtering only on one IP makes you missing eventually a lot of interactions.

The browser should show you all HTTP requests that are made for your website access. After which you could redo it at the network level to capture all trafic and such.

Another way: make sure to have a "quiet" computer, without any extra traffic or other browsing and so (or the minimum amount of traffic), and then capture all network packets just for the time of your HTTP request, and after that filter out what you really need. Otherwise if you filter too much beforehand you may never know that you miss something.

BTW: DNS uses UDP too! And your DNS packets go to your local recursive DNS server(s) (except if you run your own recursive DNS server on the same computer?), so this is not related in any way with the website IP or such.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.