Wireshark-users: [Wireshark-users] Capturing the gateway

Date: Sun, 06 Apr 2008 08:21:58 -0400
I would like to "see" what DNS server I am actually using ... as I just
switched from one to another ...seems I used to be able to do that, but not
now. And I can't remember what I've changed around

I'm using the Macbook-Pro out to my Airport-Extreme then Ethernet to the DSL-Modem :
-------------------------------------------------------
Version 1.0.0

Compiled with GTK+ 2.12.8, with GLib 2.14.6, with libpcap 0.9.8, with libz
1.2.3, without POSIX capabilities, with libpcre 7.6, without SMI, with ADNS,
without Lua, with GnuTLS 2.2.0, with Gcrypt 1.4.0, with MIT Kerberos, without
PortAudio, without AirPcap.

Running on Darwin 8.11.1 (MacOS 10.4.11), with libpcap version 0.9.8.

Built using gcc 4.0.1 (Apple Computer, Inc. build 5370).
-------------------------------------------------------------

The routing table is:
------------------------------------------------------------
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            10.0.1.1           UGSc       16        2    en1
10.0.1/24          link#5             UCS         1        0    en1
10.0.1.1           0:14:51:60:49:ad   UHLW       17       78    en1   1051
10.0.1.2           localhost          UHS         0        1    lo0
127                localhost          UCS         0        0    lo0
localhost          localhost          UH          9     6953    lo0
169.254            link#5             UCS         0        0    en1

Internet6:
Destination        Gateway            Flags      Netif Expire
localhost          localhost          UH          lo0
                   localhost          Uc          lo0
localhost          link#1             UHL         lo0
                   link#5             UC          en1
rdcv.local         0:17:f2:40:96:ce   UHL         lo0
ff01::             localhost          U           lo0
ff02::%lo0         localhost          UC          lo0
ff02::%en1         link#5             UC          en1
-----------------------------------------------------------------

what I see is a DNS query from 10.0.1.2 over to 10.0.1.1 and the returned answer.


thanks for the help