Monitoring DNS Queries using tshark

Overview

• In the internet world, requests for external data start with DNS Queries for domains. In environments with firewalls installed, DNS Queries themselves may be blocked. To understand this, it is necessary to know the current DNS Queries being made. This document outlines how to monitor DNS queries using tshark.

Installing tshark

# Installing tshark on Ubuntu
$ sudo apt-get install tshark -y

# Installing tshark on macOS
$ brew install --cask wireshark

# Installing tshark on Windows
$ choco install wireshark -y

# Verifying installation
$ tshark -v
TShark (Wireshark) 3.6.2 (Git v3.6.2 packaged as 3.6.2-2)

Monitoring DNS Queries

# Running DNS query monitoring with tshark, then executing nslookup www.google.com
$ sudo tshark -f "port 53"
Capturing on 'eth0'
 ** (tshark:138272) 17:38:22.224025 [Main MESSAGE] -- Capture started.
    1 0.000000000 172.30.159.111 → 8.8.8.8      DNS 74 Standard query 0x5ba5 A www.google.com
    2 0.064698077      8.8.8.8 → 172.30.159.111 DNS 90 Standard query response 0x5ba5 A www.google.com A 142.250.66.100

References

• Filtering a packet capture by DNS Query Name