Packet analysis would be an alternative method that works regardless of NetworkManager or other network connection tool that you use. Basic idea is to send a dns query with nslookup
and in a second terminal check where the packets go.
For that we'd need to connect to the network for the first time, so that there is nothing cluttering the connections, and run the following command:
sudo tcpdump -vv -i wlan0 -W 1200 | grep google.com
In alternative terminal run:
nslookup google.com
Once you get packets listing from the tcpdump
, check where do they go from your IP address.
For example,
$ sudo tcpdump -vv -i wlan0 -W 1200 | grep google.com
tcpdump: listening on wlan0, link-type EN10MB (Ethernet), capture size 65535 bytes
eagle.29862 > b.resolvers.Level3.net.domain: [udp sum ok] 64057+ [1au] A? google.com. ar: . OPT UDPsize=4096 (39)
b.resolvers.Level3.net.domain > eagle.29862: [udp sum ok] 64057 q: A? google.com. 11/0/0 google.com. A 173.194.115.64, google.com. A 173.194.115.65, google.com. A 173.194.115.72, google.com. A 173.194.115.66, google.com. A 173.194.115.69, google.com. A 173.194.115.78, google.com. A 173.194.115.70, google.com. A 173.194.115.71, google.com. A 173.194.115.68, google.com. A 173.194.115.67, google.com. A 173.194.115.73 (204)
eagle.16429 > b.resolvers.Level3.net.domain: [udp sum ok] 38822+ A? google.com. (28)
As you can see , my laptop,eagle
, sends packets to my university's dns , b.resolvers.Level3.net.domain
. If you want to see the IP address, you can use the -n
flag with tcpdump
.
For example:
$ sudo tcpdump -n -vv -i wlan0 -W 1200 | grep google.com
tcpdump: listening on wlan0, link-type EN10MB (Ethernet), capture size 65535 bytes
10.10.87.145.56474 > 4.2.2.2.53: [udp sum ok] 15606+ A? google.com. (28)