In this example i am looking for responses that have response time greated than 0.5 seconds: “dns.time > 0. Now you will be able to see the response times in a Column and it would be easier to spot which queries are slower or DNS server that is busy. You can call it as you like it does not have to be “DNS time” You can do this by right clicking on the Time and add it as a Column. One nice thing to do is to add the “DNS Time” to you wireshark as a column to see the response times of the DNS queries.

In this case as an example to see how a DNS error will look like we are searching for a domain that does not exist and we get the obvious error code 0011 “No such name”: You are going to use Wireshark to capture network packets, filter to select only DNS. That means it is returning an IP or CNAME or some other valid DNS repsonse. Wireshark is a powerful network packet capture and analysis tool. One nice thing to do is to add the DNS Time to you wireshark as a column to see the response times of the DNS queries. We used “>0 ” because any Standard DNS query response that has an reply code of 0 is a reply with no error. DNS is the system used to resolve store information about domain names including IP.

As a prerequisite the following post would be nice to be consulted first:įor finding DNS errors you can you use this filter: “ > 0”

Wireshark filter dns query name