0

I want to launch a HTTP request to a website I've never visited before. I would like to pick up all of the packets related to this request; so DNS packets, TCP packets, et cetera.

Is there a way to pick up all of these? I have found that I can filter by the website's IP address, but this does not give me the DNS packets. How can I get all related packets?

Improve this question
2
  • DNS doesn't go to the HTTP server, but to the DNS server. If you capture all packets, you will get the DNS packets, too.
    – Ron Maupin ♦
    Feb 6, 2017 at 4:59
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 14, 2017 at 4:34

2 Answers 2

Reset to default
1

Try this:

(ip.addr==192.0.2.4) and (http or dns)

192.0.2.4 is your PC's address.

EDIT: You could include the addresses of your DNS server and the website 

(ip.addr==<nameserver> and DNS) or (ip.addr==<website> and http)
Improve this answer
2
  • I want to exclude all of the packets that were not a part of this transaction. Is there any way to do that?
    – Daniel Paczuski Bak
    Feb 6, 2017 at 18:40
  • I suppose you could include the addresses of your DNS server and the website (ip.addr==<nameserver> and DNS) or (ip.addr==<website> and http)
    – Ron Trunk
    Feb 6, 2017 at 18:47
0

I believe you will have more luck first using the web developer part of firefox of equivalent. Because one request to a website as seen from the user perspective may mean a lot of network trafic on various other websites, to load images, scripts, CSS and such. So filtering only on one IP makes you missing eventually a lot of interactions.

The browser should show you all HTTP requests that are made for your website access. After which you could redo it at the network level to capture all trafic and such.

Another way: make sure to have a "quiet" computer, without any extra traffic or other browsing and so (or the minimum amount of traffic), and then capture all network packets just for the time of your HTTP request, and after that filter out what you really need. Otherwise if you filter too much beforehand you may never know that you miss something.

BTW: DNS uses UDP too! And your DNS packets go to your local recursive DNS server(s) (except if you run your own recursive DNS server on the same computer?), so this is not related in any way with the website IP or such.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.