[Marco van den Bovenkamp <marco@xxxxxxxxxxxxxxxxxxx>]

Moses Hernandez wrote:

> The reason you don't see the DNS response is because DNS will not respond
> back on port 53 it will only listen on that port for incoming requests.

DNS requests are sent *to* port 53 on the server (where it listens), and 
the replies are sent *from* port 53.

'udp port 53' as capture filter (which matches either source or 
destination port or both being 53) should capture both requests and 
replies, and does so for me.

I can't explain why it doesn't work for him. Perhaps he could try just 
'port 53', capturing both UDP & TCP? The server shouldn't use TCP 
(although the client *might*), but that's all I can think of.

'dns' is not valid *capture* filter syntax; it's a display filter.

--

		Regards,

			Marco.