How can I find http or https requests without a corresponding dns request?
 
  
 
  
 
 
 
 
 
 
    
        
        asked Feb 15 '18  
 
 Betty DuBois gravatar image  
 
 
 
 
    
        
        updated Feb 15 '18  
 
 sindy gravatar image  
 
 
 
 
 
I can find the packets for the requests, ssl.handshake.extensions_server_name or http.host or dns.  But how do I find ones where the dns isn't there (cache)?
 
Is this going to have to be a lua script?
 
Preview: (hide)
 
 
 
 
          
 
Comments
Is it possible to run tshark with filters and produce output in the pcap file that will allow me to map a dns query to a response?
nerdman224 gravatar imagenerdman224 (
    
        Feb 28 '18
    )
add a comment