This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

DNS query to non local and non routable IP

0

I noticed by accident my computer is sending DNS queries to 192.168.1.1 despite it's on a class A internal network (10.0.0.0).

The queries goes to the firewalls mac-adress, the firewalls IP i 10.0.0.1.

I don't have 192.168.1.1 registered as a dns server in my network settings.

I guess the query goes to the firewall because it's the default gateway and there's no static route to a 192.168.1.10 subnet? But how do I find out what and why on my computer is sending the queries to this class C address?

asked 28 Oct '13, 07:54

Molotch's gravatar image

Molotch
6●1●1●3
accept rate: 0%

what is your client OS and version?

(28 Oct '13, 08:58) Kurt Knochner ♦

Windows 7 x64 Enterprise with SP1.

(28 Oct '13, 13:31) Molotch

One Answer:

1

But how do I find out what and why on my computer is sending the queries to this class C address?

this is nothing you can solve with Wireshark, as every program on your Windows will call system APIs for DNS resolution. Thus every DNS query will be created by some system component and you will not be able to figure out which program triggered the DNS query (originally) just by looking at the network capture, as there is no information in the DNS packets about the originator.

See also here: http://ask.wireshark.org/questions/26171/how-can-i-determine-which-application-is-sending-dns-queries-to-my-bind-server?page=1&focusedAnswerId=26234#26234

So, on Windows you have the following options:

  • dump the whole network configuration and check if there is a reference to 192.168.1.1

netsh dump | find "192.168.1.1"
ipconfig /a | find "192.168.1.1"

  • search the registry for 192.168.1.1
  • Take a look a the DNS queries and the names in those queries. Maybe there are typical names that can help to identify a certain tool/software on your system.
  • get a API call tracer/monitor (search google) and try to watch calls to the DNS resolver API
  • Try to use the new Microsoft Message Analyzer to find the process that triggers the DNS queries (not sure if that would work)

Besides that, there is not much you can do on Windows, at least I don't know more than the things listed above.

Regards
Kurt

answered 28 Oct '13, 14:28

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

edited 28 Oct '13, 14:37

Thank you for a good answer. I'll try your suggestions and see what I can find out.

(29 Oct '13, 10:47) Molotch