DNS, the phone book

Names turn into numbers

Computers talk using numbers (IP addresses), but people use names like www.debian.org. The system that turns a name into a number is called DNS — think of it as the network's phone book.

So almost every connection starts with a tiny DNS query: “what is the address for this name?” Those queries are in the capture, and they are a goldmine, because they tell you the names a machine tried to reach, not just the numbers. tshark can list every name that was looked up:

tshark -r /home/student/case/capture.pcap -Y dns -T fields -e dns.qry.name 2>/dev/null

In the terminal

student@vulntech:~$ tshark -r /home/student/case/capture.pcap -Y dns -T fields -e dns.qry.name 2>/dev/null
www.debian.org
sync-update-cdn.net

Tip: -Y dns keeps only the DNS packets, and -e dns.qry.name prints the name that was asked about. Two flags, and you have every lookup.