Using Tcpdump to Filter DNS Packets

Table of Contents


Tcpdump is a very powerful Linux command to capture DNS packets. DNS is short for Domain Name System. It is a database that links meaningful names to a specific IP address. We can use tcpdump to filter DNS packets to learn more about how DNS works.

  • What is DNS?
  • Query DNS record on Linux
  • Filter DNS Packets with Tcpdump

What is DNS?

DNS or Domain Name System basically translates those domain names into IP addresses and points our device in the right direction. A domain name and its matching IP address is called A DNS record.

DNS service uses both TCP and UDP port 53. On the client-side, the frequently used port for DNS port is UDP 53. We can capture packets on this port to get the DNS query info.

Check DNS Port 53 with Examples

Query DNS record on Linux

Dig command on Linux can be used to query DNS records. By default, dig sends the DNS query to name servers listed in the resolver(/etc/resolv.conf) unless it is asked to query a specific name server.

The following command is used to query the A record for Check this post to know how to use dig command.

# dig


2 Ways to Check DNS Speed

Filter DNS Packets with Tcpdump

We can use this tcpdump command to filter DNS query packets. In the following examples, we capture packets on port eth0. Please change it to adapt to your environment.

# tcpdump -i eth0 udp port 53 or tcp port 53

We can write these packets to a file with this tcpdump command and analyze these packets with Wireshark. -w means write.

# tcpdump -i eth0 -w /tmp/dns.pcap udp port 53 or tcp port 53

Pcap file can be opened by tcpdump command to get more details about the DNS query like the hostname, A record info, txt record etc.

# tcpdump -vvv -r /tmp/dns.pcap port 53

Related Post:

20 Advanced Tcpdump Examples in Linux


4 Examples to Check DNS Record with Dig Command in Linux

DNS plays a critical role, and is often overlooked until problems arise. This book covers many aspects of domain names and DNS, and is well worth reading to better understand these topics.

Share on facebook
Share on twitter
Share on linkedin
Liquid Web Managed Word Press