7.3.1.6 Lab - Exploring DNS Traffic

Lab – Exploring DNS Traffic
Objectives
Part 1: Capture DNS Traffic
Part 2: Explore DNS Query Traffic
Part 3: Explore DNS Response Traffic
Background / Scenario
Wireshark is an open source packet capture and analysis tool. Wireshark gives a detailed breakdown of the
network protocol stack. Wireshark allows you to filter traffic for network troubleshooting, investigate security
issues, and analyze network protocols. Because Wireshark allows you to view the packet details, it can be
used as a reconnaissance tool for an attacker.
In this lab, you will install Wireshark on a Windows system and use Wireshark to filter for DNS packets and
view the details of both DNS query and response packets.
Required Resources
 1 Windows PC with Internet access and Wireshark installed
Part 1: Capture DNS Traffic
Step 1: Download and install Wireshark.

a. Install Wireshark for Windows.
b. Wireshark can be downloaded from www.wireshark.org.
c. Choose the software version you need based on your PC’s architecture and operating system. For
instance, if you have a 64-bit PC running Windows, choose Windows Installer (64-bit).
d. After making a selection, the download should start. The location of the downloaded file depends on the
browser and operating system that you use. For Windows users, the default location is the Downloads
folder.
e. The downloaded file is named Wireshark-win64-x.x.x.exe, where x represents the version number.
Double-click the file to start the installation process.
Respond to any security messages that may display on your screen. If you already have a copy of
Wireshark on your PC, you will be prompted to uninstall the old version before installing the new version.
 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Page 1 of 11 www.netacad.com
It is recommended that you remove the old version of Wireshark prior to installing another version. Click
Yes to uninstall the previous version of Wireshark.
f. If this is the first time to install Wireshark, or after you have completed the uninstall process, you will
navigate to the Wireshark Setup wizard. Click Next.
g. Continue advancing through the installation process. Click I Agree when the License Agreement window
displays.
h. Keep the default settings on the Choose Components window and click Next.
i. Choose your desired shortcut options and click Next.

j. You can change the installation location of Wireshark, but unless you have limited disk space, it is
recommended that you keep the default location. Click Next to continue.
k. To capture live network data, WinPcap must be installed on your PC. If WinPcap is already installed on
your PC, the Install check box will be unchecked. If your installed version of WinPcap is older than the
version that comes with Wireshark, it is recommended that you allow the newer version to be installed by
clicking the Install WinPcap x.x.x (version number) check box.
Finish the WinPcap Setup Wizard if installing WinPcap and accept the license agreement if necessary.
Click Next to continue.
l. Do NOT install USBPcap for normal traffic capture. Do NOT select the checkbox to install USBPcap.
USBPcap is experimental, and it could cause USB problems on your PC. Click Install to continue.
m. Wireshark starts installing its files and a separate window displays with the status of the installation. Click
Next when the installation is complete.
n. Click Finish to complete the Wireshark install process. Reboot the computer if necessary.
Step 2: Capture DNS traffic.

a. Click Start and search for Wireshark. Open Wireshark and start a Wireshark capture by double clicking
a network interface with traffic. In this example, Ethernet is the network interface with traffic.
b. Click Start and search for Command Prompt. Open Command Prompt.
c. In the Command Prompt, type ipconfig /flushdns and press Enter to clear the DNS cache.
d. Type nslookup and press Enter to enter the interactive mode.

e. Enter the domain name of a website. The domain name www.cisco.com is used in this example.
f. Type exit when finished. Close the command prompt.

g. Click Stop capturing packets to stop the Wireshark capture.
Part 2: Explore DNS Query Traffic

a. Observe the traffic captured in the Wireshark Packet List pane. Enter udp.port == 53 in the filter box and
click the arrow (or press enter) to display only DNS packets.
b. Select the DNS packet labeled Standard query 0x0002 A www.cisco.com.

c. In the Packet Details pane, notice this packet has Ethernet II, Internet Protocol Version 4, User Datagram
Protocol and Domain Name System (query).
d. Expand Ethernet II to view the details. Observe the source and destination fields.
What are the source and destination MAC addresses? Which network interfaces are these MAC
addresses associated with?
Source MAC Adress is e4:54:e8:9c:c6:b9 . Destination MAC Adress is 00:00:5e:00:01:7a
Source: Dell_9c:c6:b9 (e4:54:e8:9c:c6:b9)
Address: IETF-VRRP-VRID_7a (00:00:5e:00:01:7a)
e. Expand Internet Protocol Version 4. Observe the source and destination IPv4 addresses.
What are the source and destination IP addresses? Which network interfaces are these IP addresses
associated with?
Source: 10.122.1.41
Destination: 10.10.10.10
f. Expand the User Datagram Protocol. Observe the source and destination ports.
What are the source and destination ports? What is the default DNS port number?
Source Port: 50678
Destination Port: 53
g. Open a Command Prompt and enter arp –a and ipconfig /all to record the MAC and IP addresses of the
PC.
Compare the MAC and IP addresses in the Wireshark results to the results from the ipconfig /all results.
What is your observation?
h. Expand Domain Name System (query) in the Packet Details pane. Then expand the Flags and
Queries.
i. Observe the results. The flag is set to do the query recursively to query for the IP address to
www.cisco.com.
Part 3: Explore DNS Response Traffic

a. Select the corresponding response DNS packet labeled Standard query response 0x000# A
www.cisco.com.
What are the source and destination MAC and IP addresses and port numbers? How do they compare to
the addresses in the DNS query packets?
b. Expand Domain Name System (response). Then expand the Flags, Queries, and Answers.
c. Observe the results. Can the DNS server do recursive queries?
d. Observe the CNAME and A records in the Answers details. How do the results compare to nslookup
results?
Reflection
1. From the Wireshark results, what else can you learn about the network when you remove the filter?
2. How can an attacker use Wireshark to compromise your network security?

7.3.1.6 Lab - Exploring DNS Traffic

Uploaded by

Copyright:

Available Formats

7.3.1.6 Lab - Exploring DNS Traffic

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

7.3.1.6 Lab - Exploring DNS Traffic

Uploaded by

Copyright:

Available Formats

Lab – Exploring DNS Traffic

Part 1: Capture DNS Traffic

Step 1: Download and install Wireshark.

i. Choose your desired shortcut options and click Next.

Step 2: Capture DNS traffic.

d. Type nslookup and press Enter to enter the interactive mode.

f. Type exit when finished. Close the command prompt.

Part 2: Explore DNS Query Traffic

b. Select the DNS packet labeled Standard query 0x0002 A www.cisco.com.

Part 3: Explore DNS Response Traffic

c. Observe the results. Can the DNS server do recursive queries?

2. How can an attacker use Wireshark to compromise your network security?

You might also like