4

So I'm sniffing my DNS on wireshark. There's way too much junk because the websites include many advertising tools, web tracking, etc. Is there some blacklist that contains all those pesky hostnames, so that I can purify my wireshark a bit?

Current filter (is growing fast) :

dns && ! dns.qry.name matches "ytimg|apple|skype|google|akamai|yt3|arpa|youtube|microsoft|facebook|amazon|twitter|gravatar|instagram|azure|lastpass|trafficjunky|tumblr|gstatic" && ! ip.src_host matches "google"
2

The list of advertising tools, web tracking, etc. is infinite and changes daily so you could try to use a list like others have provided but it's not a scaleable or reasonable solution. Instead perhaps use the statistics features in wireshark or export and do some analysis to see abnormalities like the nosiest dns entry or the quiet ones or the largest packets or the hosts with changing ip addresses , etc

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.