How to set Wireshark to log ONLY DNS requests?

Question

This works:

tethereal -i eth0 -w /root/mycapture.pcap

but it captures every packet. I only need to capture DNS requests. Is this possible? The server is Linux.

Other thing is: is it possible to have the file saved over a network to another computer? The server only has a small hard drive that's not big enough for the capture file.

Thanks.

Answer 1

Specify a capture filter using -f "port 53".

Side note: It's tshark now, not tethereal anymore.

---

To capture locally but store the data on a remote server, use - or /dev/stdout as the output file, and pipe the command to ssh:

tshark -i eth0 -f "port 53" -l -w - | ssh otherhost "cat > foo.pcap"

tcpdump -i eth0 -f "port 53" -l -w - | ssh otherhost "cat > foo.pcap"

You can also do the opposite – capture on a remote server but store data locally:

ssh otherhost "tshark -i eth0 -f "port 53" -l -w -" > foo.pcap

ssh otherhost "tcpdump -i eth0 -f "port 53" -l -w -" > foo.pcap

Note: Always specify a capture filter when storing data like this. If you don't, each packet will cause an infinite loop.