Finding the program causing issue using Wireshark

[BrotherZero]

Hey all,

 

Let me start off by saying that I had never used Wireshark until yesterday.

 

I'm an IT student and was recently assigned a Wireshark packet analysis project. I was given a Wireshark output file and told that the server in question was on an intranet behind a hardened firewall and was trying to reach a Google DNS server, creating suspicious traffic. I need to find what's causing it plus why and some solutions. My guess is that it is perhaps a program trying to update itself (Hense trying to reach the Google DNS server). However, I have no idea how to go about finding the program or proving my theory.

 

Any and all help is appreciated. Thank you!

[2FA]

You want to use what are called Display Filters, these filter packets based off the criteria inputted. They can also get very complicated though I think this should be simple.

 

Specifically you'll want to make use of the ip.dst==x.x.x.x filter where x.x.x.x is the IP address of the Google DNS server. This will display any packets where the destination is the Google DNS server.

[2FA]

Also, since the traffic you see will be DNS requests think of what those requests contain. You can view that in the bottom part of Wireshark when a packet is selected.

[BrotherZero]

3 minutes ago, DeadEyePsycho said:

Also, since the traffic you see will be DNS requests think of what those requests contain. You can view that in the bottom part of Wireshark when a packet is selected.

When I set up the filters as you said all the black lines with red text disappear. I am not sure what to make of all the information at the bottom, the only thing that stood out to me was the source port. But I'm not sure what to do with it.

[2FA]

12 hours ago, JaysonJacob said:

When I set up the filters as you said all the black lines with red text disappear. I am not sure what to make of all the information at the bottom, the only thing that stood out to me was the source port. But I'm not sure what to do with it.

You might want to watch some tutorial videos.