Timeline for tcpdump/wireshark aren't seeing DNS requests from browser or ping on Mac OS
Current License: CC BY-SA 4.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 14 at 11:27 | history | edited | Lethargos | CC BY-SA 4.0 |
small corrections
|
| Oct 14 at 11:22 | comment | added | Lethargos | @bmike Only now have I seen your comment. Yes, iterm2 has access to the local network (I asked a question related to that a few days ago and it's got solved. I also immediately thought of that afterwards. It doesn't seem to affect it in any way) | |
| Oct 14 at 10:38 | history | edited | Lethargos | CC BY-SA 4.0 |
formatting
|
| Oct 13 at 8:50 | comment | added | Lethargos | Caching is not the problem. I've made sure to query completely new domains. Moreoever, as I've added later, tcpdump works consistently when turning off IPv6. (the browsers are set to not use DoH or a DNS proxy or whatever) | |
| Oct 13 at 3:12 | comment | added | Gordon Davisson |
It won't sent DNS queries for anything it's already looked up and cached the results for. You can clear the system resolver's cache with sudo killall -HUP mDNSResponder (see this and this). Note that some programs (mostly browsers) may do their own lookups (and have their own caches) rather than using the system resolver.
|
|
| Oct 12 at 21:47 | comment | added | bmike♦ | Good catch with IPv4 and IPv6 management. Also, do the apps (wire shark and terminal app of choice) you use show up as being granted local network permissions? support.apple.com/guide/mac-help/… | |
| Oct 12 at 20:33 | history | edited | Lethargos | CC BY-SA 4.0 |
added 334 characters in body
|
| Oct 11 at 20:54 | comment | added | Lethargos | Well, your question is partially part of my question. "These apps" are just Firefox/Chrome and ping itself. And "nuanced" setups, well, these are relatively well known. On Fedora I can see exactly how Firefox sends DNS requests, there's no issues with that. On top of that, I did say that I can see the requests when I reconnect to the network, it's like a sort of leak. | |
| Oct 11 at 14:54 | comment | added | bmike♦ | Are you certain those apps are using those ports to resolve names? I expect modern browsers to have more nuanced setups, results to be cached locally, and you’ll need to examine all traffic. Is this perhaps an XY question where you’re hoping to do something and DNS is your lever or first step? | |
| S Oct 11 at 14:18 | review | First questions | |||
| Oct 11 at 14:54 | |||||
| S Oct 11 at 14:18 | history | asked | Lethargos | CC BY-SA 4.0 |