1

I am analysing a Wireshark capture as part of understanding UDP/TCP, DNS and HTTP concepts and how packets are sent.

I found an interesting sequence of messages in the Wireshark file, but I am not sure how to interpret them. The first message is a DNS query packet of type A. Two lines after that is the type AAAA query. After each of those are UDP messages that are encrypted. After checking the IP address of the host I got that it's a VPN server somewhere in Hungary. I found this video that explains how packets appear when one is connected to a VPN, but unlike my capture all the packets are encrypted in the second capture.

Why are the packets mixed in this case. Are they irrelevant to each other or is the VPN being used in connection to the DNS requests for that website's IPv4&IPv6? If yes, does that mean that a VPN is being used for another reason and what could that be?

Edit: Here's the capture! Wireshark capture Could this be the client doing multiple things like @RonTrunk suggested?

Improve this question
4
  • 1
    It's hard to tell without seeing the packet capture. It might be the host doing multiple things. Please edit your question to include the wireshark display
    – Ron Trunk
    Mar 1 at 19:09
  • @RonTrunk I have added the image!
    – Tita
    Mar 1 at 19:14
  • 1
    The DNS is IPv6, and the UDP is IPv4. Those are two separate, incompatible protocols that have nothing to do with each other.
    – Ron Maupin ♦
    Mar 1 at 19:34
  • @RonMaupin I see, thank you for the comment.
    – Tita
    Mar 1 at 20:02

3 Answers 3

Reset to default
4

From your capture it appears that you are seeing data from two different hosts. The DNS queries and the UDP packets likely have nothing to do with each other.

It's possible that one host is performing two separate tasks, using both IPv4 and IPv6 addresses. You'd have to know more about your network (where in the network was the capture taken?) in order to be sure. But again, the DNS queries and the UDP packets are most likely unrelated.

Improve this answer
1
  • Thank you for your answer! I think I understand it much better now!
    – Tita
    Mar 1 at 20:09
2

The UDP traffic you see to 185... is QUIC (HTTPS over UDP.) They are 100% unrelated to the DNS queries for "play.google.com". (should be obvious as they happen before the queries are even answered, and to a different address.)

Improve this answer
0

It could be the second traffic is unrelated or it could be data that is loaded as part of the result of the play.google.com lookup. Simply the client device loading HTTPS content from some web resource that is part of the web page or resource the client requested. Images, html code, etc.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.