TCP is the second stage of accessing a website and this setups the communication so we can transfer the HTTP requests. Highlighted in red is the type A record with IP Address 52.216.240.196 – the website address. The local Gateway will then r ecursively resolve the DNS lookup (IE do all the work) and reply to the Macbook Air with the IP Address of the website. Also note the DNS transaction is between the Macbook Air and the local Gateway at 192.168.1.1.

A records resolve IP version 4 addresses to domains and AAAA records resolve IPv6 addresses to domains. In order there is an A record request, AAAA record request, an A record response and AAAA record response. We put in the website URL in the Chrome browser and the first thing that happens is the DNS lookup.īy filtering on udp.port = 53, we see 4 DNS packets. There are 3 main stages when accessing a website: So, the walk-through below will focus on HTTP, so we can view the details of the HTTP packets. In a previous post, MadPackets walked-through an HTTPS request to a static website hosted on AWS S3. Obviously, a public website won’t share the private key but if you are building your own server/website, you can decrypt the contents of HTTPS using the private key. A Wireshark packet capture will not natively display the HTTPS packets, but if you have the server private key, you can decrypt the capture and view the contents in Wireshark. Transport Layer Security (TLS) provides the encryption for HTTPs traffic with algorithms such as SHA-256. In fact, the majority of websites default to using HTTPS.

In a real-world example, a user may be sitting at home browsing the internet – IE going to web pages, where the web page is hosted on AWS.

Wireshark http and dns lac