When running tcpdump like this

tcpdump -s96 -i eth0 ip -w output_filename

is it possible to tell tcpdump to get the entire packet when a packet is a DNS request/response?


Unfortunately, no.

The underlying BPF engine could do it on some platforms, but the filter language that compiles to BPF code doesn't support that (and it would take either a change to the filter language, or a change to the tcpdump command-line syntax to support multiple filters and -s flags, to support that, as well as significant changes to the BPF compiler, so that's not likely to happen soon).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.