DNS query capture with link header

Show DNS lookups with MAC addresses (-e) to map queries to clients on the LAN

tcpdump -nn -e -i any port 53
tool
tcpdump18 commands
tags
tcpdumpdnsnetworktroubleshooting

More tcpdump commands

  • Capture on interface
    tcpdump -i eth0 -n

    Capture all traffic on eth0 without DNS resolution

  • Capture to file
    tcpdump -i eth0 -w /tmp/capture.pcap

    Save raw packets to PCAP file for Wireshark analysis

  • Read PCAP file
    tcpdump -r /tmp/capture.pcap -n | head -50

    Replay and display packets from a saved PCAP file

  • Filter by host
    tcpdump -i any host 10.0.0.5 -n

    Capture only traffic to/from a specific IP

  • Filter by port
    tcpdump -i eth0 port 443 -n

    Capture HTTPS traffic only

all 18 tcpdump commands