Ali, > I'm looking for help to write a tcpdump filter that only dumps dns queries > that are looking for the hostname corresponding to the IP 123.123.123.12 ... > I'm thinking about something like : > tcpdump udp dst 123.123.123.12 port 53 , # tcpdump proto udp and port 53 and dst 123.123.123.12 should do the trick. cheers, Anth