Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to record all outgoing A records on a RedHat PC. I tried using tcpdump:

nohup tcpdump -K dst port 53 -w $tcpdumpdns > /dev/null 2>&1 &

It makes an output file like:

19:26:12.185392 IP > google-public-dns-a.google.com.domain: 51198+ A? yahoo.com. (27)

So I need to process that to get the yahoo.com:

echo $tcpdumpdns | awk '/ A\? / {u = NF - 1; print $u}' | sed 's/^www.//g; s/.$//g' | sort -u

Is there any better solution to gather all the outgoing A record requests?

p.s.: collecting DNS A records is only needed to have an up-to-date list of websites that are reachable via HTTPS. So I can generate xml files for HTTPSEverywhere Firefox Add-on. So this is just a part of a script.

share|improve this question
What's wrong with the solution you provided? – Michael Mrozek Dec 20 '11 at 19:26
do you have a GUI env, if so using wireshark-gtk is an easier solution, since you can filter there much easily. – Hanan N. Dec 20 '11 at 19:29
@Hanan N.: GUI is not an option. this is needed to be automatic. – LanceBaynes Dec 20 '11 at 19:34
@Michael Mrozek: I hope nothing. But I asked because I'm open for alternative solutions. – LanceBaynes Dec 20 '11 at 19:34
up vote 7 down vote accepted

Use Wireshark:

tshark -f "udp port 53" -Y "dns.qry.type == A and dns.flags.response == 0"
share|improve this answer

If you don't have wireshark installed then

tcpdump -lvi any "udp port 53" | tee $tcpdumpdns

should work for you. As you wanted to limit the output to the second to last value then I would parse your log file with:

grep -E 'A\?' $tcpdumpdns |sed -e 's/^.*A? //' -e 's/ .*//'|sort -u

If you want it live then:

tcpdump -lvi any "udp port 53" 2>/dev/null|grep -E 'A\?'|awk '{print $(NF-1)}'

should do it, (here sed and awk are interchangeable; and I would pick awk.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.