1

I have been trying to figure out how many sites does firefox connect wth and for that have been using wireshark. What I have done is made a new profile and whenever I run firefox in the browser it is with 

$ firefox --ProfileManager --safe-mode

Obviously before this command is run I run -

$ script

$ tshark -V -i wlan0

I set it by instructions from https://superuser.com/questions/319865/how-to-set-up-wireshark-to-run-without-root-on-debian

and had added myself to wireshark group.

So, what I did was run these three commands one after other -

$ script

$ tshark -V -i wlan0

and finally -

$ firefox --ProfileManager --safe-mode

The new tab/window opens and I'm able to capture the packets. Immediately after, I shut down the browser..

Now I need to grep through the packets. around 80 odd packets which came like -

Queries
        self-repair.mozilla.org: type A, class IN

which seems to be answered by the amazon domain -

Answers
        self-repair.mozilla.org: type CNAME, class IN, cname self-repair.r53-2.services.mozilla.com
            Name: self-repair.mozilla.org
            Type: CNAME (Canonical NAME for an alias) (5)
            Class: IN (0x0001)
            Time to live: 57
            Data length: 40
            CNAME: self-repair.r53-2.services.mozilla.com
        self-repair.r53-2.services.mozilla.com: type CNAME, class IN, cname shield-normandy-elb-prod-2099053585.us-west-2.elb.amazonaws.com

Is there a way to grep through the contents so that a list of domains which were touched can be known instead of trawling manually ?

Update - Did the -

$ tshark -V -i wlan0 -w trace1.pcap
Improve this question
4
  • Would not it been easier sudo tdpdump -i wlan0 port 53 or if you insist in seeing particular HTTP requests sudo ngrep -d wlan0 "GET" "port 80"?
    – Rui F Ribeiro
    Oct 9, 2016 at 17:45
  • I am not an expert but just learning things . Also it seems tdpdump doesn't seem to be packaged for debian, using existing tools.
    – shirish
    Oct 9, 2016 at 18:24
  • $ apt-file list tdpdump $ As can be seen there is no output and I'm on Debian Stretch/testing. Aha, it seems you made a mistake, you meant tcpdump . I am open to using but you will need to share more details what ports are needed and how to go about doing that.
    – shirish
    Oct 9, 2016 at 18:25
  • As I said. The full command is sudo tcpdump -i wlan0 port 53 for listening to the DNS requests-
    – Rui F Ribeiro
    Oct 9, 2016 at 18:37

1 Answer 1

Reset to default
1

Write the captured packet data into a file with the -w option and read it into wireshark, or capture directly in wireshark. Then select the Request item of the HTTP submenü in the Statistics menu.

Improve this answer
2
  • Actually that didn't work. What I had done is renamed the typescript file to a-new-profile.txt file. I then tried to open the file in wireshark and it said it's a corrupt file even though I can read the file in any text-editor without any issues.
    – shirish
    Oct 10, 2016 at 16:28
  • The typescript is decoded info for human consumption. What you need (and what tshark -w <FILE> produces) is the raw captured data in PCAP format. This is what you can read into wireshark.
    – Ferenc Wágner
    Oct 10, 2016 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.