Take the 2-minute tour ×

I am a bit confused with the abundant tcpdump tutorials on internet. I am having a few of the virtual machines running on a virtualization server.Where I am debugging a problem.Port 53 is the one in problem. I have a bridged setup where out of 4 LAN cards on the machine in question one is active and it is xen-br0 I want to check if there is any request coming on port 53 on the server by other machines on LAN in question. I also want to see if the guest operating systems on LAN or any other machine is sending traffic at port 53.Due to abundant messages being generated via tcpdump I am finding it difficult to grep the output at desired port.

So how can I use it if some one can give an example that would be helpful. Thanks in advance.

share|improve this question

3 Answers 3

up vote 3 down vote accepted

You can use this command: tcpdump -n -s 1500 -i eth0 udp port 53 (Replace 'eth0' with the name of your ethernet interface, e.g. 'fxp0') This shows all packets going in and out of your machine for UDP port 53 (DNS) Source:DNS exercise 1

share|improve this answer
thanks for your tip.It solved my problem I just have one more doubt you used 1500 what is that used for I read the man page for -s option but I could not understand this option. –  Registered User Mar 6 '11 at 20:42
That's for reading the whole packet (otherwise tcpdump only reads the headers) –  Guido van Brakel Mar 6 '11 at 22:27

If you only want to see who is talking with whom on port udp/tcp 53 without requiring to have the detailed payload of such conversation, your best bet is to use netflow.

I would dare to guess that you are using linux. If so, you could use ulogd to generate the netflow information from the traffic you are receiving and then process it using nfdump (if you are command-line oriented) and/or nfsen (if you are more of the visual type) (nfdump/nfsen are part of the same opensource project).

As an example, ulogd is enabled with only one iptables rule:

-A INPUT -j ULOG --ulog-cprange 48 --ulog-qthreshold 50

and having fprobe-ulog running so each and every flow generated by ulogd goes to the netflow collector (in this case nfdump) listening on the port you have configured nfdump to listen for (in this case port 9995):

29040 ?        Ssl   65:55 /usr/sbin/fprobe-ulog -Xeth0:100 localhost:9995

So if you want to know, who has trying to talk to your server on port udp/tcp 53, you could query your flows using nfdump:

root@my_machine:/usr/local/nfdump/bin/nfdump -R 2011 'dst port 53 && dst ip  XXX.XXX.212.184' | more
2011-01-07 06:23:28.031     0.000 UDP    ->  XXX.XXX.212.184:53           1       63     1
2011-01-07 20:34:07.287     0.000 UDP ->  XXX.XXX.212.184:53           1      119     1
2011-01-08 04:29:53.287     0.000 UDP ->  XXX.XXX.212.184:53           1       57     1
2011-01-28 08:47:45.171     0.000 UDP ->  XXX.XXX.212.184:53           1      119     1
2011-02-18 04:56:48.359    22.335 UDP ->  XXX.XXX.212.184:53           3      211     1
2011-02-18 04:57:07.363     9.026 TCP ->  XXX.XXX.212.184:53           3      144     1
2011-02-18 04:58:48.845     2.389 UDP ->  XXX.XXX.212.184:53           2      116     1
2011-02-18 04:58:48.844     8.385 TCP ->  XXX.XXX.212.184:53           3      144     1
2011-02-18 04:59:00.829    32.490 UDP ->  XXX.XXX.212.184:53           5      339     1
2011-02-18 04:59:22.738     9.132 TCP ->  XXX.XXX.212.184:53           3      152     1
Summary: total flows: 310, total bytes: 47456, total packets: 839, avg bps: 0, avg pps: 0, avg bpp: 56
Time window: 2011-01-07 06:23:28 - 2011-03-03 05:57:55
Total flows processed: 3087449, Blocks skipped: 0, Bytes read: 161058180
Sys: 0.966s flows/second: 3193300.5  Wall: 0.854s flows/second: 3611887.9

For this specific issue you are describing, installing ulogd and nfdump/nfsen may sound overkill but experience tells me that having your infrastructure netflow enabled will greatly help you in any kind of traffic/security troubleshooting you may need to do in the future so it may very well worth the effort.

share|improve this answer
your suggestion is good I will try it out.But the machine where I want to use is a non GUI server which is on SSH access.I am trying to debug an issue with out Apache Reverse Proxy where the vhosts are querying the DNS which is itself proxied.So I want to know the use of tcpdump.I have been very confused with tcpdump tutorials on net. –  Registered User Mar 6 '11 at 20:37

Hey I know this is not a complete solution, but it is quick and might come in handy

lsof -i:53

This should give you an idea of what using the port. (ps I have never used it for dns)

share|improve this answer

Your Answer


