Contents

Introduction

WireShark - Windows and MacOS both support loopback capture

DNSQuerySniffer (Windows)

Introduction

This document describes how to capture outbound DNS queries. The Umbrella roaming client doesn’t currently have a method for capturing all the outbound DNS queries it makes. If you need to capture DNS, you can use one of these tools.

WireShark - Windows and MacOS both support loopback capture

Wireshark allows you to capture packets sent to the local loopback interface (127.0.0.1), therefor allowing you to see DNS requests sent to the Umbrella roaming client whether encrypted or unencrypted.

Capture on all active network interfaces especially when local DNS resolution is a factor

DNS Only

If you only want to look at DNS requests.

DNS + HTTP

If you only want to look at DNS and HTTP request.

Filter out debug lookups (probes)

If you are not explicitly testing checking for probe-related issues or issues with debug.opendns.com, you can filter out debug.opendns.com by typing this in the filter bar:

For more information about harnessing the power of Wireshark, see these resources:

- http://packetlife.net/media/library/13/Wireshark_Display_Filters.pdf

- http://wiki.wireshark.org/DisplayFilters

DNSQuerySniffer (Windows)

DNSQuery Sniffer is a DNS-only network sniffer for Windows which monitors and displays tons of useful data. Unlike Wireshark or Rawcap, it’s only used for DNS, and is much easier to examine and extract relevant information. However, it does not have the powerful filtering tools of Wireshark.

This is a lightweight and easy-to-use tool. A huge advantage to using this is that you can sniff packets while the Umbrella roaming client service is disabled, start the capture, and suddenly you are seeing every DNS query that the Umbrella roaming client sends from the moment it starts, rather than starting a capture after the Umbrella roaming client has already started.

There are two capture methods:

- Method One—If you select the regular network interface, only queries that are on the Internal Domains list or that did not specifically go through the dnscryptproxy are shown.

These columns appear on the far right in the capture and you have to scroll over quite a bit.

- Method Two—If you select the Loopback interface, all DNS queries that are sent through the dnscryptproxy are shown, but the true destination IP address for domains on the Internal Domains list are not shown; however, the query and answer are displayed.

These columns appear on the far right in the capture and you have to scroll over quite a bit.

The results look like this:

View of an individual lookup: