I am trying to route all DNS queries from my computer through my server. My laptop seems to be sending the queries to the server, but I'm unable to monitor them on the server.

On the client (my laptop) I have my name servers in /etc/resolv.conf set to that of my server.

My laptop seems to be sending the DNS queries to my server as this is confirmed in Wireshark where it shows the DNS queries destination port as my server. The server also responds.

If I run the command:

nslookup clarks.com

The response is (server IP blanked out):

Server:     xx.55.xxx.xxx
Address:    xx.55.xxx.xxx#53

Non-authoritative answer:
Name:   clarks.com

I have tcpdump running on the server using the following command:

tcpdump -n udp port 53

Any ideas what could be going wrong? To note, my server doesn't have a DNS server running, but I still should be able to see the requests before they hit the firewall right?

What could be causing the DNS packets to either not reach the server (even though wireshark shows it does), or why tcpdump isn't capturing the packets?

  • 1
    You said "my server doesn't have a DNS server running" and you also said "The server also responds.". I have trouble understanding how the server could be responding if there is no server running there. – Celada Apr 25 '15 at 13:16
  • What is your actual question? What exactly is not working? You said that the packet capture does show the requests and responses? – Celada Apr 25 '15 at 13:17
  • @Celada Which is why I'm confused. If I send a DNS request from a service online, I see it in tcpdump, and it shows no response. – NickWebber Apr 25 '15 at 14:22
  • @Celada the question is Why isn't tcpdump capturing the requests. Even though there isn't a DNS server, the packets should still be visible. I included all that information just to let the reader know what was going on, what I'd tried, and what's happening. I don't want a DNS server, I'm attempting to write software to create a DNS tunnel, but that's not relevant to the question. – NickWebber Apr 25 '15 at 14:23
  • 1
    I'm still missing something. Wireshark shows it but tcpdump doesn't? Those two pieces of software basically do the same thing! What does "from a service online" mean? Maybe this calls for a network diagram or something, annotated with "I see requests HERE with this source IP and that dest IP and responses THERE ..." – Celada Apr 25 '15 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.