Investigate a DNS Lookup with Wireshark

Capture and decode a DNS lookup in Wireshark, then save an annotated case file.

Introduction

30 Second Summary

Every time you visit a website, your computer must discover which internet address to contact. That brief exchange usually disappears into the background.

In this project, you will use Wireshark to capture and investigate a DNS lookup generated by your Windows PC. You will turn the packet capture into an annotated case file that another analyst can verify.

What You'll Build

You will reopen dns-investigation.pcapng in Wireshark to demonstrate what your computer asked and what answer it received.

By the end of this project, you'll have:

A saved DNS case file you can reopen to demonstrate a lookup generated by your own computer.
A focused packet view that uses the dns display filter to isolate the relevant query and response.
An analyst finding that records the query name, transaction ID, returned IPv4 address, TTL, and why the traffic is expected.
Secret Mission: Compare the successful lookup with a guaranteed negative lookup under the special-use invalid. domain.

Are there any prerequisites?

You need a Windows PC with Wireshark installed. You also need basic networking knowledge and permission to capture traffic generated by your own computer.

Before We Start

This opening checkpoint sets the boundary for your investigation: you will capture only traffic generated by your own Windows PC. It also locks in your goal of explaining one DNS query and its response.

Verify Your Windows Capture Setup

A packet investigation cannot begin until Wireshark can access a real network interface. Your DNS case file needs packet evidence generated by your own Windows PC.

Npcap provides live capture access to Wireshark. Windows Command Prompt lets you generate a controlled lookup with nslookup.

In this step, get ready to:

Confirm that Wireshark version 4.6.9 is installed.
Prove that Npcap can capture packets from an active network interface.
Test the interactive nslookup prompt in Windows Command Prompt.

Check the Wireshark version

Using the required Wireshark version keeps the interface labels consistent throughout the investigation. The About window shows the installed version before you capture any traffic.

Press the Windows key to open Windows search.
Type Wireshark into the search bar.
Press Enter to open Wireshark.
Click Help in the top menu.
Click About Wireshark to display the installed version.

Choose the tab that matches what you see in the About Wireshark window.

✔️ I see the required version

The About Wireshark window shows version 4.6.9. Your analyzer is ready for the live capture test.

ⓧ I see an earlier version

A version earlier than 4.6.9 needs an update before you continue.

Open the official Wireshark download page in your browser.
Select Windows x64 Installer for an x64 PC.
Select Windows Arm64 Installer if your PC uses Arm64.
Open the downloaded installer from your browser's downloads list.
Allow the installer to continue if Windows requests permission.
Keep Npcap selected in the installer.
Complete the installer with the default options.

Why keep Npcap selected?

Npcap gives Wireshark access to live traffic from your network interfaces. The capture test depends on this driver.

Return to Windows search after the installation completes.
Type Wireshark into the search bar.
Press Enter to open the updated installation.
Click Help in the top menu.
Click About Wireshark to confirm version 4.6.9.

Installer giving you trouble?

Help me update Wireshark while keeping Npcap installed. You can also search the Wireshark Q&A community.

ⓧ Wireshark does not open

Reinstalling Wireshark restores the application files. Keeping Npcap selected also repairs the component needed for live packet capture.

Open the official Wireshark download page in your browser.
Select Windows x64 Installer for an x64 PC.
Select Windows Arm64 Installer if your PC uses Arm64.
Open the downloaded installer from your browser's downloads list.
Allow the installer to continue if Windows requests permission.
Keep Npcap selected in the installer.
Complete the installer with the default options.

Why reinstall Npcap?

Wireshark uses Npcap to receive live packets from Windows network interfaces. Reinstalling both components gives the capture test a clean starting point.

Return to Windows search after the installation completes.
Type Wireshark into the search bar.
Press Enter to open Wireshark.
Click Help in the top menu.
Click About Wireshark to confirm version 4.6.9.

Wireshark still not opening?

Help me troubleshoot a Wireshark installation that does not open on Windows. You can also search the Wireshark Q&A community.

Wireshark is now open at version 4.6.9. The next check proves that it can receive live packets.

Test live packet capture

The moving activity graphs on the welcome screen reveal which interfaces are carrying traffic. A short capture confirms that Wireshark can read packets through Npcap.

Close the About Wireshark window.
Locate the interface whose activity graph is moving on the welcome screen.

Before you start the capture, do you expect the packet list to stay empty or begin filling with rows?

Double-click the active interface to start a short capture.
Wait until packet rows appear in the packet list.
Click Capture in the top menu.
Click Stop to end the capture.

The stopped capture remains populated with packet rows. That is the key setup proof that your active interface and Npcap capture access work.

No interfaces or packet rows?

Close Wireshark.
Open the official Wireshark download page in your browser.
Download the installer that matches your Windows PC.
Open the downloaded installer from your browser's downloads list.
Keep Npcap selected to repair or reinstall capture access.
Complete the installer with the default options.
Repeat the short capture on the interface with a moving activity graph.

Help me troubleshoot missing interfaces or packet rows in Wireshark. You can also search the Wireshark Q&A community.

Test the nslookup prompt

The nslookup command can open an interactive prompt for repeated lookups. Reaching that prompt confirms that Windows can generate the controlled lookup used in the next step.

Press the Windows key to open Windows search.
Type Command Prompt into the search bar.
Press Enter to open Windows Command Prompt.

Before you enter the command, what change do you expect to see in Command Prompt?

Start the interactive lookup prompt by entering this command:

nslookup

What should I see?

The prompt changes to >. This confirms that the interactive nslookup session is ready to accept a domain name.

Return to the standard Command Prompt by entering:

exit

What does exit do?

The exit command closes the interactive nslookup session. Your standard Command Prompt returns so it is ready for the next step.

You have now verified both sides of the workflow. Wireshark can capture packet rows from the active interface, while Windows Command Prompt can start and exit the nslookup prompt.

Prompt did not change?

Confirm that you entered nslookup in Windows Command Prompt.
Check the spelling of nslookup.
Close Command Prompt.
Repeat the test in a fresh Command Prompt window.

Help me troubleshoot why the nslookup interactive prompt does not open in Windows Command Prompt.

Your capture tools are ready. Next, you will record a real lookup for example.com and save the resulting packet capture.

Capture a Real DNS Lookup

Your setup check proved Wireshark can capture packets from the active interface on your Windows PC. You now have a reliable starting point for a controlled lookup.

The first analyst challenge is noise from unrelated traffic. An unfiltered packet capture makes one DNS exchange hard to follow in the full packet list.

In this step, get ready to:

Start a fresh unfiltered capture on the active network interface.
Generate a controlled lookup for example.com with nslookup.
Save the stopped capture as dns-investigation.pcapng.

Prepare a clean capture session

A capture filter limits which packets Wireshark records. An empty capture filter keeps the surrounding interface traffic in your evidence.

Closing the short test capture may trigger a save prompt. You can discard that test because this step creates a fresh capture.

Close the short test capture by pressing Ctrl+W.
Discard the short test capture if Wireshark asks whether to save it.

You'll return to the Wireshark welcome screen with the available network interfaces listed.

Identify the same active interface by its moving activity graph.

The moving graph confirms that this is still the interface carrying your current network traffic.

Leave the capture filter field empty.
Double-click the active interface to start the fresh capture.

That first live signal is in place: packet rows are now filling the packet list.

Why leave the capture unfiltered?

The unfiltered capture preserves the traffic around your lookup. This creates the same noise an analyst must handle when investigating a larger packet list.

No packet rows appearing?

Stop the empty capture.
Return to the welcome screen.
Select the interface whose activity graph is moving.
Start the capture again.

If the interface still stays empty, help me diagnose why Wireshark is not capturing packets from my active interface.

Generate the DNS lookup

The Windows Command Prompt from earlier sends the controlled request from your own PC. The interactive nslookup session lets you submit the domain while Wireshark records the traffic.

Switch back to the Windows Command Prompt from earlier.
Start the interactive lookup session by entering this command:

nslookup

What does this command do?

The command starts an interactive lookup session. It waits for you to enter the domain name you want to resolve.

You'll see the prompt change to >.

Before you submit the domain, do you expect the response to contain address information?

Query example.com by entering:

example.com

What does this input do?

The input asks your configured DNS resolver for information about example.com. The domain name becomes the known input for your investigation.

You'll see returned address information in Command Prompt. Your controlled DNS event is now part of the live capture.

No address information returned?

Check that the prompt showed > before you entered the domain.
Confirm that your Windows PC still has a working network connection.

If the lookup still does not return address information, help me troubleshoot the nslookup session without changing the Wireshark capture.

Return to Command Prompt by entering:

exit

Why exit the session?

The input closes the interactive lookup session. Command Prompt remains available while you return to your capture.

You'll see the regular Command Prompt again.

Secure the packet evidence

Stopping the capture freezes the collected packet list for review. Saving it in the pcapng format turns that evidence into a local file you can reopen.

Before you inspect the stopped capture, do you expect one DNS exchange to stand out or blend into the surrounding traffic?

Switch back to Wireshark.

You'll see packet rows continuing to update because the interface is still recording traffic.

Select Capture from the menu bar.
Select Stop.

The packet rows stop updating. The lookup traffic is surrounded by unrelated packets in the unfiltered list.

Finding one query and response by eye is awkward. That shortfall is the intended analyst problem.

Select File from the menu bar.
Select Save As….

You'll see the dialog for saving the stopped capture.

Enter dns-investigation.pcapng as the file name.
Confirm that pcapng is selected as the format.

The dialog now shows the exact case file name and capture format required for the investigation.

Select Save.

What did you save?

The file contains the stopped unfiltered capture from your active interface. Its packet list includes the traffic generated while nslookup queried example.com.

Capture not saved?

Confirm that the capture is stopped if Save As… is unavailable.
Repeat the save action if the Wireshark title bar does not show dns-investigation.pcapng.
Check that the file name ends with .pcapng.

If the capture still does not save, help me save my stopped Wireshark capture as a pcapng file.

Before the final check, what should remain visible if the capture was stopped and saved successfully?

Check the Wireshark title bar for dns-investigation.pcapng.
Scan the populated packet list for traffic recorded during your example.com lookup.

You'll see the saved file name with a populated unfiltered packet list. The lookup traffic remains mixed with the surrounding packets.

That is the evidence secured: dns-investigation.pcapng now contains your controlled lookup inside a realistic packet list. Next, you will isolate the DNS exchange and identify the fields that explain what happened.

Isolate and Decode the DNS Exchange

The saved dns-investigation.pcapng packet capture now contains the example.com lookup you generated. It also contains every unrelated packet captured during that short window.

In this step, you will use a DNS display filter in Wireshark to isolate the query and its matching response. The filter narrows the visible rows without deleting packets from your saved capture.

In this step, get ready to:

Narrow the packet list with the dns display filter.
Identify the query's transaction ID and query name.
Match the response to its IPv4 answer and TTL.

Filter the packet list

Look at the full packet count at the bottom of the Wireshark window.
Record that count here: your unfiltered packet count.
Click the display filter toolbar near the top of Wireshark.
Enter dns.
Press Enter to apply the filter.
Compare the displayed rows with your unfiltered packet count.

You should see fewer rows than the full packet count. The visible rows now focus on the DNS traffic from your lookup.

What Does a Display Filter Change?

A display filter controls which captured packets Wireshark shows in the packet list. Every original packet remains inside dns-investigation.pcapng.

This gives you a focused investigation view while preserving the complete capture as evidence.

Is the Filtered List Empty?

Confirm dns-investigation.pcapng remains loaded in Wireshark.
Clear the toolbar entry to confirm the mixed packet list returns.
Re-enter dns without spaces or punctuation.

Help me troubleshoot an empty DNS display in Wireshark.

Inspect the DNS query

Each DNS exchange uses a transaction ID to connect a request with its reply. The query name records the domain that the DNS resolver was asked to look up.

Select the query packet for example.com in the filtered packet list.
Expand Domain Name System in the packet details pane.
Select the transaction ID field represented by dns.id.
Record the displayed ID here: your observed DNS transaction ID.
Select the query name field represented by dns.qry.name.
Confirm its value is example.com.

You now have the domain requested by your computer and the identifier that follows this exchange.

Cannot Identify the Query Packet?

Use the packet summaries to find a row associated with example.com.
Select each candidate packet until its details show dns.qry.name with the value example.com.

Help me distinguish the DNS query from its response.

Match the DNS response

A DNS response repeats the query's transaction ID so the client can pair the two packets. Its answer data contains the returned address and the lifetime of that answer.

Select the matching response packet in the filtered packet list.
Expand Domain Name System in the packet details pane.
Select the response field represented by dns.id.
Confirm its value matches your observed DNS transaction ID.

The shared transaction ID links this response to the query you inspected.

Expand the answer details inside the DNS response.
Select the IPv4 answer field represented by dns.a.
Record the returned address here: your observed IPv4 answer.
Select the time-to-live field represented by dns.resp.ttl.
Record the displayed value here: your observed DNS TTL.

How Do These Fields Tell the Story?

The dns.id value links the query to its matching response.
The dns.qry.name value identifies the requested domain.
The dns.a value records the returned IPv4 address.
The dns.resp.ttl value shows how long the answer can be cached.

Before the final check, predict what relationship you will see between the two transaction IDs.

Select the query packet again.
Confirm dns.qry.name displays example.com.
Compare its dns.id value with your observed DNS transaction ID.
Select the matching response packet.
Compare its dns.id value with your observed DNS transaction ID.
Confirm dns.a matches your observed IPv4 answer.
Confirm dns.resp.ttl matches your observed DNS TTL.

The filtered list should show the example.com query with its matching response. Both packets should share your observed DNS transaction ID.

The response should show your observed IPv4 answer through dns.a. It should show your observed DNS TTL through dns.resp.ttl.

You have turned a noisy capture into a linked DNS story that another analyst can verify. Next, you will embed that evidence in the capture as a concise analyst finding.

Document the Analyst Finding

You have isolated the example.com DNS query from the surrounding traffic. Its matching response shares the transaction ID you recorded.

Packet fields become useful security evidence when another analyst can trace each conclusion to the capture. This step turns your observations into a concise finding stored inside dns-investigation.pcapng.

In this step, get ready to:

Add the observed DNS evidence to a capture-file comment.
Save the comment inside dns-investigation.pcapng.
Reopen the case file to prove the finding persists.

Write the analyst finding

A defensible finding separates packet observations from your assessment. Your assessment identifies this traffic as the expected lookup you generated during the lab.

The query travels to the DNS resolver. That packet's destination IP address is the resolver address for your finding.

Select the example.com query packet in Wireshark.
Identify the query packet's destination IP address.
Record that resolver address here: your observed DNS resolver address.
Select Statistics from the menu bar.
Select Capture File Properties.

What should the finding include?

The query name is example.com.
The DNS resolver is your observed DNS resolver address.
The transaction ID is the shared dns.id value you recorded.
The IPv4 answer is the observed dns.a value you recorded.
The TTL is the observed dns.resp.ttl value you recorded.
Your assessment states that the traffic was an expected lookup generated during the lab.

Type a concise finding in Capture file comments using the six evidence points above.

You should see the complete finding inside the comment field. Each recorded value should match the filtered packets.

Save the comment in the capture

The comment becomes part of your case file when you save it into the capture. Saving the capture preserves that finding for the next analyst who opens the file.

Select Save Comments.

Your finding should remain visible in Capture File Properties.

Close the dialog.

You should return to the filtered packet list with the DNS exchange still visible.

Select File from the menu bar.
Select Save.

Comment not staying in the file?

Confirm the saved filename is dns-investigation.pcapng.
Return to Capture File Properties to confirm the comment is present.

Ask for help checking why the comment is not persisting in the capture.

Reopen and verify the case file

Reopening the file tests whether your evidence survives outside the current session. A portable case file must retain its captured packets plus its analyst finding.

Before you reopen the file, do you think the packets and embedded comment will survive together?

Close dns-investigation.pcapng in Wireshark.
Reopen dns-investigation.pcapng from its saved location in Wireshark.

You should see the saved packet rows repopulate the packet list.

Enter dns in the display filter toolbar.
Press Enter.

You should see the example.com query plus its matching response in the filtered packet list.

Select Statistics from the menu bar.
Select Capture File Properties.

You should still see your analyst finding under Capture file comments. The persisted comment proves that the packet evidence remains documented inside the saved capture.

Strong work. Your case file now keeps its packet evidence beside your analyst conclusion.

Close the Capture File Properties dialog.

The dns-investigation.pcapng file remains open with dns applied. The filtered DNS exchange is ready for another analyst to review.

Secret mission

Investigate a Failed DNS Lookup

A successful lookup shows normal resolution. Capture a lookup for `invalid.` to document the negative path. Account for the case where Windows sends no DNS packet.

Clean Up Your Resources

Your two Wireshark captures are local files with no ongoing charges. Choose whether to keep them privately, pause your investigation, or delete them entirely.

Resources you used:

The annotated dns-investigation.pcapng capture containing the successful example.com lookup.
The annotated dns-success-vs-failure.pcapng capture comparing the successful lookup with the negative invalid. behavior.

Keep everything running

No cleanup is needed. Choose this if you want to reopen the captures or demonstrate your investigation again.

Keep dns-investigation.pcapng as your successful DNS lookup case file.
Keep dns-success-vs-failure.pcapng as your comparison case file.
Review each capture for network metadata before sharing it.

Pause - I'll come back to this later

Pausing ends the current analysis session while preserving both capture files for later.

Close Wireshark.
Close Windows Command Prompt.
Leave dns-investigation.pcapng in its saved location.
Leave dns-success-vs-failure.pcapng in its saved location.

Delete - I don't want to use this again

Remove both capture files if you do not want to retain the recorded network traffic.

In Windows, search for dns-investigation.pcapng by its exact filename.
Delete dns-investigation.pcapng from the folder shown in the search result.
In Windows, search for dns-success-vs-failure.pcapng by its exact filename.
Delete dns-success-vs-failure.pcapng from the folder shown in the search result.
Search for dns-investigation.pcapng again to confirm no saved copy remains.
Search for dns-success-vs-failure.pcapng again to confirm no saved copy remains.

Nice Work!

You did it! You turned traffic from your own Windows PC into a portable DNS investigation that another analyst can reopen and verify.

Your two saved capture files now demonstrate a repeatable workflow in Wireshark. They preserve the packet evidence alongside your analyst findings.

You learned how to:

Capture a controlled DNS lookup from your active network interface with Wireshark and Npcap. Save the result as dns-investigation.pcapng.
Use the dns display filter to isolate the query from background traffic. Connect the queried name to its shared transaction ID. Identify the returned IPv4 address. Read the response TTL.
Create an evidence-based analyst finding that documents the resolver address and observed packet fields. Embed the finding inside the capture file so it remains available when the file is reopened.
Secret Mission: Compare the successful example.com lookup with the negative invalid. behavior. Preserve the comparison in dns-success-vs-failure.pcapng.

Ready to quiz yourself?