Capturing and viewing DNS queries using tcpdump

tcpdump is an excellent tool for debugging network issues. Even though the name says TCP, it works just as well for capturing DNS requests which happen over UDP.

Capture DNS queries #

tcpdump -i eth0 -w /tmp/dns.pcap udp port 53

View captured DNS queries #

tcpdump -vvv -r /tmp/dns.pcap port 53

Capture the DNS queries into a file and also stream them on the console #

tcpdump -i eth0 -U -w - udp port 53 | tee /tmp/dns.pcap | tcpdump -vvv -r -