0

I'm a CS student and currently taking a (basic) course in information security. I was given an assignment which required me to analyse a given .pcap file using Wireshark and obtain information on the host's IP address, browser, router's MAC address etc. One of the questions required me to determine the IP address of the DNS server which the host uses, but I'm not sure how to do that. I've seen websites that tell you how to find the IP address of the DNS server used by your own router, but how do we find the IP address of the DNS server another person uses, given that we know the MAC address of his or her router?

Improve this question

3 Answers 3

Reset to default
3

I would assume that if you have a pcap of traffic from the target host, you could determine the IP address of the DNS server by looking for open connections to a destination IP on the DNS port (TCP/UDP 53).

Improve this answer
0

Just use a filter for DNS traffic. Look for replies from the DNS server with your client IP as the destination. For example, you could try something like dns and ip.dst==1.2.3.4 (where 1.2.3.4 should be replaced with the IP address of your client).

Improve this answer
0

Wireshark also resolves MAC addresses too. Its a tool option that you van select. Further look for traffic as stated above that is running on the default dns port. You can also view protocol conversations.

Improve this answer

You must log in to answer this question.