How to filter wireshark to see only dns queries that are sent/received from/by my computer?

Question

I am new to wireshark and trying to write simple queries. To see the dns queries that are only sent from my computer or received by my computer, i tried the following:

dns and ip.addr==159.25.78.7

where 159.25.78.7 is my ip address. It looks like i did it when i look at the filter results but i wanted to be sure about that. Does that filter really do what i am trying to find out? I doubted a little bit because in the filter results i also see only 1 other result whose protocol is ICMP and its info says "Destination unreachable (Port unreachable)".

Can anyone help me with this?

Thanks

@alfasin why do i use localhost instead of my ip address? Is my filter wrong? — yrazlik, Nov 27 '13 at 19:24
The title of your question is misleading... you already know how to filter, your problem is with the unreachable destination. This might help: http://www.wildpackets.com/resources/compendium/tcp_ip/unreachable — Nir Alfasi, Nov 27 '13 at 19:38

score 17 · Accepted Answer · edited Dec 23 '21 at 23:43

17

I would go through the packet capture and see if there are any records that I know I should be seeing to validate that the filter is working properly and to assuage any doubts.

That said, please try the following filter and see if you're getting the entries that you think you should be getting:

dns and (ip.dst==159.25.78.7 or ip.src==159.57.78.7)

This filter will show only DNS traffic from 159.57.78.7 or to 159.25.78.7.

edited Dec 23 '21 at 23:43

galoget

722
9
15

answered Nov 27 '13 at 19:24

carloandaya

196
2
5

1

Thanks, it looks like your filter and mine is the same because ip.addr refers to both source and destination – yrazlik Nov 27 '13 at 19:26

score 11 · Answer 2 · answered Nov 27 '13 at 19:58

11

Rather than using a DisplayFilter you could use a very simple CaptureFilter like

port 53

See the "Capture only DNS (port 53) traffic" example on the CaptureFilters wiki.

answered Nov 27 '13 at 19:58

Ioan Alexandru Cucu

11,981
6
37
39

score 3 · Answer 3 · edited Dec 15 '15 at 05:36

3

use this filter:

(dns.flags.response == 0) and (ip.src == 159.25.78.7)

what this query does is it only gives dns queries originated from your ip

edited Dec 15 '15 at 05:36

Serjik

10,543
8
61
70

answered Dec 15 '15 at 04:46

itzkmv

43
4

score 0 · Answer 4 · answered Jan 03 '23 at 13:08

0

You can capture by adding filter udp==53 to see all dns queries

answered Jan 03 '23 at 13:08

Tayyab Awais

1

How to filter wireshark to see only dns queries that are sent/received from/by my computer?

4 Answers4

Linked