Capture and decode twenty DNS queries and responses
Build a paste-ready command, then review its compatibility and effects before running it.
sudo tcpdump -ni <interface> -c <count> -vvv 'port 53'Complete required fields to copy the generated command.
cautionrequires privileges Compatibility
Linux + macOSVerified for Linux, macOS using bash, zsh syntax.
Operational knowledgereview due 2027-01-19
Requirementstcpdumptcpdump must be installed and available on PATH.Elevated accessReview the exact scope before using an elevated account.
Version supporttcpdump Current supported releasesVerified for linux, macos using bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signals09:44:12.018421 IP 192.168.1.42.52914 > 1.1.1.1.53: 4321+ A? api.example.com. (33)Representative successful output; values vary with the selected target and system state.
Known errorstcpdump: command not foundtcpdump is missing or is not available on PATH.Permission deniedThe current identity does not have the required access.
Verifysudo tcpdump -ni {{interface}} -c {{count}} -vvv 'port 53'Re-run the corresponding read-only inspection and confirm the intended state.Rollback noteNo universal automatic rollback is available. Capture the current state and use the tool-specific recovery procedure before applying changes.
Command breakdown
01sudoPrivilege elevationRuns the following command with elevated privileges after authorization.
02tcpdumpCommandRuns the tcpdump stage of this one-liner.
03-niOptionConfigures tcpdump with the -ni option.
04<interface>ParameterA value supplied in the Fill parameters section.
05-cOptionConfigures tcpdump with the -c option.
06<count>ParameterA value supplied in the Fill parameters section.
07-vvvOptionConfigures tcpdump with the -vvv option.
08'port 53'ArgumentPasses 'port 53' to tcpdump.
This advanced community-curated one-liner combines several stages. Review every option and placeholder before running it.
Example input
sudo tcpdump -ni eth0 -c 20 -vvv 'port 53'
Example output
09:44:12.018421 IP 192.168.1.42.52914 > 1.1.1.1.53: 4321+ A? api.example.com. (33)
09:44:12.031002 IP 1.1.1.1.53 > 192.168.1.42.52914: 4321 1/0/0 api.example.com. A 203.0.113.18 (49)
Illustrative output — exact values vary by system and data.
Official sources