tcpdump: filter DNS queries

2 min read | by Jordi Prats

When a DNS change is involved in an ongoing issue, we need to be sure when we use, for example curl, whether we are hitting the new or the old resource. Is that DNS record still cached locally? One of the best ways of checking this is by sniffing the DNS traffic using tcpdump

To let tcpdump interpret correctly the information that going within a DNS query and response we will have to add the -s option for specifying the amount of data to capture for each packet. By setting it to 0 we will be able to capture the entire packet. This value actually is 262144 which it is far more data than a packet is going to usually handle (1500 would be closer but it also depends on the underlying network)

Also adding -n will prevent tcpdumo to resolve IP addresses which for troubleshooting it is also a good thing to add. The final command would be:

# tcpdump -n -s 0 port 53

The output we will get from this command will look like follows:

19:31:23.062314 IP > 18585+ A? (32)
19:31:23.062384 IP > 21145+ AAAA? (32)
19:31:23.174448 IP > 21145 0/1/0 (86)
19:31:23.180454 IP > 18585 1/0/0 A (48)

In this example it is querying to it's resolver (, which is replying back that it is

Posted on 30/03/2021