When running tcpdump like this

tcpdump -s96 -i eth0 ip -w output_filename

is it possible to tell tcpdump to get the entire packet when a packet is a DNS request/response?

1 Answer 1


Unfortunately, no.

The underlying BPF engine could do it on some platforms, but the filter language that compiles to BPF code doesn't support that (and it would take either a change to the filter language, or a change to the tcpdump command-line syntax to support multiple filters and -s flags, to support that, as well as significant changes to the BPF compiler, so that's not likely to happen soon).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .