Get public IPs of accessed webpages?

Question

I would like to be able to get the public IPs of the websites I am accessing with my PC in a way such as:

www.google.es - public IP1 
www.cdn.facebook.com - public IP2

and so on. I think this should be done by logging DNS traffic, so I tried using wireshark as part of a solution I found in another answer:

tshark -f "udp port 53" -Y "dns.qry.type == A and dns.flags.response == 0"

However this seems to only show connections between my router and my machine, the list is full of pairs such as:

192.168.200.250 -> 192.168.200.1
192.168.200.1 -> 192.168.200.250`

Answer 1

You can install DNSmasq locally and add this option to the conf file log-facility=/var/log/dnsmasq.log log-queries then set your system to use 127.0.0.1 or ::1 as the DNS resolver its work for me.

Then extract data as any format you want and do what ever you want with it

or install Bind locally. Most distros default install of Bind will be non-autoritative caching-only and add a logging {} config block (as described in the Bind 9 Configuration Reference).

Answer 2

This little script may provide the results you're looking for. I've avoided DNS lookups, instead preferring to use actual HTTP requests (ports 80/http and 443/https).

tshark -nlp -f '(port 80 or port 443) and (tcp[tcpflags] & (tcp-syn|tcp-ack)) == (tcp-syn|tcp-ack)' 2>/dev/null |
    stdbuf -oL awk '{print $3}' |
    while IFS= read -r ip
    do
        name=$(dig +short -x "$ip")
        printf "%-16s%s\n" "$ip" "${name:-$ip}"
    done |
    uniq

Example output

212.58.244.27   bbc-vip146.telhc.bbc.co.uk.
78.129.164.123  free.hands.com.
195.20.242.89   195.20.242.89

This code will generate results only for HTTP requests, whereas searching on DNS queries will find anything and everything. However, be aware that it generates the names from a rDNS lookup on the IP address, so there is not always a direct correspondence between the HTTP hostname you accessed and the name returned in the results.