Tcpdump is a very powerful Linux command to capture DNS packets. DNS is short for Domain Name System. It is a database that links meaningful names to a specific IP address. We can use tcpdump to filter DNS packets to learn more about how DNS works.
What is DNS?
DNS or Domain Name System basically translates those domain names into IP addresses and points our device in the right direction. A domain name and its matching IP address is called A DNS record.
DNS service uses both TCP and UDP port 53. On the client-side, the frequently used port for DNS port is UDP 53. We can capture packets on this port to get the DNS query info.
Query DNS record on Linux
Dig command on Linux can be used to query DNS records. By default, dig sends the DNS query to name servers listed in the resolver(/etc/resolv.conf) unless it is asked to query a specific name server.
The following command is used to query the A record for howtouselinux.com. Check this post to know how to use dig command.
# dig howtouselinux.com
Filter DNS Packets with Tcpdump
We can use this tcpdump command to filter DNS query packets. In the following examples, we capture packets on port eth0. Please change it to adapt to your environment.
# tcpdump -i eth0 udp port 53 or tcp port 53
We can write these packets to a file with this tcpdump command and analyze these packets with Wireshark. -w means write.
# tcpdump -i eth0 -w /tmp/dns.pcap udp port 53 or tcp port 53
Pcap file can be opened by tcpdump command to get more details about the DNS query like the hostname, A record info, txt record etc.
# tcpdump -vvv -r /tmp/dns.pcap port 53
DNS plays a critical role, and is often overlooked until problems arise. This book covers many aspects of domain names and DNS, and is well worth reading to better understand these topics.