DNS query capture with link header tcpdump

Show DNS lookups with MAC addresses (-e) to map queries to clients on the LAN

tcpdump -nn -e -i any port 53

#tcpdump #dns #network #troubleshooting

more tcpdump all 18 commands →

Capture on interface tcpdump -i eth0 -n Capture to file tcpdump -i eth0 -w /tmp/capture.pcap Read PCAP file tcpdump -r /tmp/capture.pcap -n | head -50 Filter by host tcpdump -i any host 10.0.0.5 -n Filter by port tcpdump -i eth0 port 443 -n