Like This Blog 0

Added by Mike Danseglio May 29, 2015

“What is my computer doing on the internet?”
“What servers does this new software talk to?”
“Where are these cloud files kept?”
“Does {insert any software here} use the internet all the time or does it ask me first?”

I get these kinds of questions all the time. Many users and administrators want to know what their software is connecting to, both internet and intranet resources.

I’ve seen some very complex answers to this problem including packet analyzers, network sniffers, and even router-based logging. But there are much simpler and inexpensive tools that are already built in to Windows.

Using Ipconfig to List the DNS Resolution Cache

Pretty much every modern software package relies on TCP/IP for network communication. The software provides a server name and lets TCP/IP take care of the rest. And almost universally, computers use the Domain Name System (DNS) to resolve server (or host) names to IP addresses for communication.

To list the host names that Windows has recently resolved, simply open a command prompt and type ipconfig.exe /displaydns as shown in Figure 1.

Figure 1. This list just keeps going…

My list is pages and pages long. Some of the hosts are easily recognizable, like linkedin.com. Others are a bit more difficult to interpret.

Even though the default cache time is 5 minutes, if the computer has been running for some time you probably want to clear the list first. To do that, simply run ipconfig.exe /flushdns. That will clear all previous DNS resolution entries and only show new resolution entries.

Enjoy!

Mike Danseglio -CISSP / MCSE / CEH
Interface Technical Training – Technical Director and Instructor