How to filter wireshark to see only dns queries that are sent/received from/by my computer?

dns wireshark packet-capture
yrazlik picture yrazlik · Nov 27, 2013 · Viewed 99.3k times · Source

I am new to wireshark and trying to write simple queries. To see the dns queries that are only sent from my computer or received by my computer, i tried the following:

dns and ip.addr==159.25.78.7

where 159.25.78.7 is my ip address. It looks like i did it when i look at the filter results but i wanted to be sure about that. Does that filter really do what i am trying to find out? I doubted a little bit because in the filter results i also see only 1 other result whose protocol is ICMP and its info says "Destination unreachable (Port unreachable)".

Can anyone help me with this?

Thanks

Answer

carloandaya picture carloandaya · Nov 27, 2013

I would go through the packet capture and see if there are any records that I know I should be seeing to validate that the filter is working properly and to assuage any doubts.

That said, please try the following filter and see if you're getting the entries that you think you should be getting:

dns and ip.dst==159.25.78.7 or dns and ip.src==159.57.78.7

Related questions

How do I solve the "server DNS address could not be found" error on Windows 10?

After installing Windows 10, I am continuously getting the "server DNS address could not be found" error. I will be able to use the Internet for 4-5 minutes, and after that for 20-25 min I will get the above error. How …

Read More
ssh: Could not resolve hostname [hostname]: nodename nor servname provided, or not known

I am trying to set up a VPN with a Raspberry Pi, and the first step is gaining the ability to ssh into the device from outside my local network. For whatever reason, this is proving to be impossible and …

Read More
How do I get a list of all subdomains of a domain?

I want to find out all the subdomains of a given domain. I found a hint which tells me to dig the authoritative Nameserver with the following option: dig @ns1.foo.bar some_domain.com axfr But this never works. …

Read More