DNS is a protocol responsible for resolving names to the IP addresses. In this recipe, we will learn how to filter important parameters that are related to the DNS service.
When suspecting a network problem, port mirror the suspected server or install Wireshark on it, then, start capturing the data.
There are some common filters that will assist you in troubleshooting DNS problems. The common display filters are given as follows:
dns
.dns.flags.response == 0
dns.flags.response == 1
dns.flags.rcode == 0
, marked in the following screenshotdns.flags.rcode == 3
dns.qry.name == "URL Name"
dns.qry.name contains "URL Name"
dns.flags.opcode == 0
dns.flags.opcode == 1
dns.flags.opcode == 2
dns.flags.opcode == 4
dns.flags.opcode == 5
dns.flags.recdesired == 1
dns.flags.recdesired == 0
All other display filters can be found by clicking on the expression button on the right-hand side of the display filter window at the top of the Wireshark window.
Display filters are described in depth in Chapter 3, Using Display Filters. As described in Chapter 3, Using Display Filters, you can do one of the following things to filter DNS parameters:
DNS is quite a complicated protocol, and the purpose of this chapter is to provide methods to resolve common problems with this protocol and implementation. Not all filters are mentioned here; a full list of DNS filters can be found at http://www.wireshark.org/docs/dfref/d/dns.html.
18.223.184.42