At the network layer, where
tcpdump sees the packets, the connection to the user process is not available. The
ss tool has the option
-p to list the processes associated with a network connection. As
ss only shows the information at a point in time, you will have to run it often, and may still lose information about short connections.
To know what was transmitted, you can run
tcpdump and capture everything, later you can filter the captured packets for the local port numbers you got from
This won't give you direct information about the DNS names used, because connections are always to IP addresses. But you can search your network capture for DNS requests that respond with the IP address of the connection later used, this will let you know the DNS names used unless there are requests to different DNS names that use the same IP address.
If you really want to know what the process is doing, use
strace. You will see the DNS namessent to the resolver as well as everything that is transmitted, even for short lived connections.