What it does
dnstop analyzes DNS packets and displays tables of sources, destinations, query types, response codes and queried domains.
Point dnstop at a capture device or a saved tcpdump file, then switch among tables of client addresses, query types, domain levels and response codes. Filters isolate cases such as NXDOMAIN, SERVFAIL or private-range reverse lookups. Its supplied manual defaults to queries on UDP port 53; select replies when response codes matter, since query-only input cannot supply them. That manual also says TCP is unsupported. Live capture needs permission to access the capture device. For redirected, noninteractive output, use a saved file: dnstop reads it fully before printing the top entries. The view covers packets at that capture point.
Strengths
- DNS-focused aggregation and response filters
- Live or saved-capture input
Best for
- Finding patterns in DNS traffic
Sources
- GitHub - measurement-factory/dnstop: Stay on top of your DNS traffic · GitHub (Oct 26, 2026)
- dnstop supplied manual (Oct 26, 2026)