Tcpdump Filter DNS Packets: How-To & Examples

To capture only DNS traffic with tcpdump, use the filter port 53 or udp port 53, since DNS queries and responses normally use UDP or TCP on port 53. For example, sudo tcpdump -i eth0 -n port 53 prints every DNS packet on that interface without resolving hostnames. This article explains the syntax, common variations, and how to read the output.

Background: DNS and Tcpdump

The Domain Name System (DNS) translates human-readable names like example.com into IP addresses. When your computer needs to resolve a name, it sends a DNS query to a resolver, which replies with an answer. These messages are small, typically under 512 bytes, and are carried inside UDP datagrams on port 53. If a response is too large for UDP, or if the connection uses DNS over TCP (DoT), the traffic moves to TCP on the same port.

Tcpdump is a command-line packet analyzer that uses the Berkeley Packet Filter (BPF) syntax. BPF lets you select packets based on protocol, port, host, or even specific flags. The filter port 53 is the simplest way to see all DNS traffic, because it matches any packet whose source or destination port is 53.

Basic Filter Syntax

The most direct filter is port 53. It captures both UDP and TCP packets that have port 53 as either the source or destination. To be more specific, you can add the protocol:

udp port 53 – only UDP DNS (most common)
tcp port 53 – only TCP DNS (zone transfers, large responses, DoT)
port 53 and host 8.8.8.8 – DNS traffic to or from a specific server
port 53 and src net 192.168.1.0/24 – DNS from your local subnet

You can also use udp port 53 or tcp port 53 to explicitly combine both, though port 53 already does that.

Capturing DNS with Tcpdump: Examples

Here are practical commands you can run as root (or with sudo):

sudo tcpdump -i eth0 -n port 53 – captures DNS packets on interface eth0, showing numeric IPs.
sudo tcpdump -i any -n -vvv port 53 – verbose output on all interfaces, useful for debugging.
sudo tcpdump -i wlan0 -w dns.pcap port 53 – saves the captured packets to a file for later analysis in Wireshark.
sudo tcpdump -i eth0 -n 'tcp port 53 and (tcp[13] & 2 != 0)' – captures only TCP DNS packets with the SYN flag set (new connections).

The -n flag prevents tcpdump from doing reverse DNS lookups, which would generate extra DNS traffic and clutter your capture. The -vvv flag increases verbosity, showing extra fields like the DNS transaction ID.

Reading the Tcpdump Output

When you capture DNS packets, tcpdump prints one line per packet. A typical UDP DNS query looks like this:

12:34:56.789012 IP 192.168.1.10.54321 > 8.8.8.8.53: 12345+ A? example.com. (29)

Breaking it down:

Timestamp: 12:34:56.789012
IP: protocol (IPv4)
Source: 192.168.1.10.54321 (IP and source port)
Destination: 8.8.8.8.53 (IP and destination port)
Transaction ID: 12345 (hexadecimal)
Flags: + means recursion desired (RD flag set)
Query type: A (IPv4 address) or AAAA (IPv6), MX, CNAME, etc.
Question: example.com
Length: (29) – total packet size in bytes

Responses show similar info but include the answer count and often the resolved IP address. For example:

12:34:57.001234 IP 8.8.8.8.53 > 192.168.1.10.54321: 12345 1/0/0 A 93.184.216.34 (49)

Here 1/0/0 means one answer, zero authority, zero additional records.

Common Problems and Solutions

If you see no output when using port 53, check these:

Wrong interface: Use -i any to listen on all interfaces, or list interfaces with tcpdump -D.
Permissions: Tcpdump requires root privileges. Use sudo or run as root.
Firewall: Some firewalls may block or alter DNS traffic, preventing tcpdump from seeing it.
DNS caching: Your system may cache DNS responses, so no packets are sent. Clear the cache or query a new domain.
Encrypted DNS: If you use DNS over HTTPS (DoH) or DNS over TLS (DoT), the traffic is not on port 53. DoH uses port 443, and DoT uses port 853. Adjust your filter accordingly (e.g., tcp port 853).

Another common issue: tcpdump may truncate packets if the snapshot length is too small. Use -s 0 to capture full packets.

Comparing with Other Tools

Tcpdump is a command-line tool that runs on Unix-like systems. For a graphical interface, Wireshark uses the same capture engine but offers a GUI and protocol dissectors that decode DNS fields in detail. If you need to filter DNS in Wireshark, you can use the display filter dns or udp.port == 53.

For continuous monitoring, you might use tcpdump -l to pipe output to other tools like grep or awk. For example:

sudo tcpdump -i eth0 -n -l port 53 | grep 'A?'

This shows only DNS queries of type A.

Safety and Privacy Considerations

Capturing DNS traffic can reveal a lot about users’ browsing habits, as every domain visited generates a DNS query. If you capture on a shared network, be aware of privacy laws. Always obtain permission before sniffing traffic on a network you do not own. When saving captures to a file, protect it with appropriate permissions, as it may contain sensitive information.

Also note that tcpdump does not decrypt encrypted DNS traffic. If you use DoH or DoT, you will see the connection but not the query contents.

Frequently Asked Questions

How do I capture only DNS queries, not responses?
You can filter by the DNS flag. For UDP, the query has the QR bit set to 0. A BPF filter for that is udp[10] & 0x80 == 0 (byte 10 is the flags field). For TCP, the offset is different. Simpler: capture all DNS and use grep to filter lines containing A? or AAAA?.

Why do I see DNS traffic on port 53 but also on other ports?
Some DNS servers use non-standard ports. Also, your system may send DNS to a local resolver on port 53, but the resolver forwards to upstream on a different port. Use port 53 to capture both.

Can tcpdump capture DNS over HTTPS (DoH)?
Yes, but you need to filter on port 443 and then inspect the TLS handshake to identify the domain. Tcpdump cannot decrypt the DNS payload, so you won’t see the query names. For that, use a proxy or a tool like Wireshark with TLS keys.

How do I count the number of DNS packets?
Use tcpdump -c 100 to stop after 100 packets, or pipe to wc -l to count lines. For example: sudo tcpdump -i eth0 -n port 53 | wc -l will print a count when you stop the capture.

What is the difference between udp port 53 and tcp port 53?
UDP is the default transport for DNS queries and responses. TCP is used for zone transfers, large responses, and some recursive queries. If you only care about typical lookups, use UDP. If you want to see all DNS, use port 53 without a protocol.

Does tcpdump affect DNS performance?
Capturing packets can add overhead, especially on high-traffic interfaces. On a busy server, it may drop packets. Use -n to avoid reverse DNS lookups and -s 0 to capture full packets, but be aware that heavy capture can slow down the system.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →