What it does
dnscap is a DNS-focused packet-capture utility that writes pcap data and can filter queries, responses, addresses and collection periods.
Select queries, responses or both, narrow the source and destination addresses, and align start/stop times with the investigation. dnscap writes binary PCAP and can create new files periodically, with support for IPv4, IPv6, UDP, TCP and IP fragments. It needs a collection point that can see the relevant traffic; a missing capture is not evidence about traffic elsewhere. The optional post-close script hook can upload each finished file, so capture storage is not necessarily local when that hook is configured. Review the chosen filters, window and destination before sharing packet data. DNS-OARC publishes the software under BSD licensing.
Strengths
- DNS-specific capture selection
- Timed collection and output rotation
Watch out for
- Needs access to the traffic being investigated
Sources
- DNSCAP - DNS traffic capture utility | DNS-OARC (Oct 26, 2026)