Troubleshoot Packet and DNS Captures in Umbrella Roaming Client

Available Languages

Download Options

PDF (445.2 KB)
View with Adobe Reader on a variety of devices
ePub (517.4 KB)
View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle) (567.4 KB)
View on Kindle device or Kindle app on multiple devices

Updated:August 22, 2025

Document ID:224668

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

WireShark - Windows and MacOS both support loopback capture

DNSQuerySniffer (Windows)

Introduction

This document describes how to capture outbound DNS queries. The Umbrella roaming client doesn’t currently have a method for capturing all the outbound DNS queries it makes. If you need to capture DNS, you can use one of these tools.

WireShark - Windows and MacOS both support loopback capture

Wireshark allows you to capture packets sent to the local loopback interface (127.0.0.1), therefor allowing you to see DNS requests sent to the Umbrella roaming client whether encrypted or unencrypted.

Capture on all active network interfaces especially when local DNS resolution is a factor

WireShark Capture Dashboard

DNS Only

If you only want to look at DNS requests.

DNS + HTTP

If you only want to look at DNS and HTTP request.

Filter: dns or http

Filter out debug lookups (probes)

If you are not explicitly testing checking for probe-related issues or issues with debug.opendns.com, you can filter out debug.opendns.com by typing this in the filter bar:

Filter: dns && not dns contains debug.opendns.com

For more information about harnessing the power of Wireshark, see these resources:

DNSQuerySniffer (Windows)

DNSQuery Sniffer is a DNS-only network sniffer for Windows which monitors and displays tons of useful data. Unlike Wireshark or Rawcap, it’s only used for DNS, and is much easier to examine and extract relevant information. However, it does not have the powerful filtering tools of Wireshark.

This is a lightweight and easy-to-use tool. A huge advantage to using this is that you can sniff packets while the Umbrella roaming client service is disabled, start the capture, and suddenly you are seeing every DNS query that the Umbrella roaming client sends from the moment it starts, rather than starting a capture after the Umbrella roaming client has already started.

There are two capture methods:

Method One—If you select the regular network interface, only queries that are on the Internal Domains list or that did not specifically go through the dnscryptproxy are shown.

These columns appear on the far right in the capture and you have to scroll over quite a bit.

DNS Sniffer Regular Inquiries

Method Two—If you select the Loopback interface, all DNS queries that are sent through the dnscryptproxy are shown, but the true destination IP address for domains on the Internal Domains list are not shown; however, the query and answer are displayed.

These columns appear on the far right in the capture and you have to scroll over quite a bit.