I have been using the configurantion file(web.mate) below to try and capture the DNS ip from the third parties web sites but unfortunelly no sucess. The configuration file works fine but i am only getting my router IP and my machine ip. Can someone shed some light to my torment or even provide me with a hint where i am going wrong??? Many Thanks Felgueiras
asked 08 Mar ‘14, 05:47 Astrokilla23 edited 09 Mar ‘14, 03:23 Kurt Knochner ♦ |
One Answer:
I don't think that MATE can do that, as the page that get's loaded is totally unrelated to the previous TCP connection. The only 'link' between those two connections is the link in the HTML code of the web page transmitted in the first tcp connection. So, you would have to
AFIAK, there is no way to do that with MATE, especially because of the HTML parsing part! Can you describe what you are trying to do? Maybe there is another solution. Regards answered 09 Mar '14, 11:42 Kurt Knochner ♦ edited 09 Mar '14, 11:43 Hi Kurt thanks once again to take your time to answer my queries. I am doing a project on wireshark, called "Visualization of Third-Party websites" using Wireshark.I was instructed to use MATE because it can create group of protocols.By using mate i thought that i could create a gop of DNS's IP's and consequently use GEO IP to display their location on the map.I hope this gives you an insight of what i am trying to achieve.Can you please help me to get aroud this issue ?? Thanks Astrokilla. (10 Mar '14, 13:15) Astrokilla23 I'm not quite sure what you are trying to do. Do you want to visualize 'nested' content in web pages, by geoip mapping the addresses of the hostnames in those 'nested' links? If so, I'm pretty sure you can't do that with MATE (see my explanation above), so there is no (simple) way around this 'issue'. (10 Mar '14, 15:37) Kurt Knochner ♦ Well the visualization bit i can use any ip tracker website i am mostly interested in capturing the IP's and consequently track them if thats fine.... (10 Mar '14, 16:12) Astrokilla23 |
what exactly do you mean by: “the DNS ip from the third parties web sites”?
Isn’t the destination IP address of the conversation, the address of the web site?
Thanks for replaying to my question Kurt .What i trying to explain is that the source ip and destination ip are almost same(there’s only two ip in which changes to source and destination)!!!So if i am on a web page and then a click on the add banner(Third party web site)i should be able to get the ip o source of the add() is coming from ???