[Android Apps and Games] DiamondJohn:
Interesting alternative option to log DNS requests

Just came across the following, and thought it looked pretty interesting. I liked it, as it did not require any pre-config / thought.

I ran it in ADB over WiFi, as root, didnt try as non root.

tcpdump -vvAs0 port 53

Example output, shows that it has logged my DNS requests

# tcpdump -vvAs0 port 53
tcpdump: listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes
11:04:37.773079 IP (tos 0x0, ttl 64, id 53443, offset 0, flags [DF], proto UDP (17), length 60)
192.168.1.19.59982 > one.one.one.one.domain: [udp sum ok] 40878+ A? www.google.com. (32)
E..<..@.@..1.........N.5.($..............[COLOR="Red"]www.google.com[/COLOR].....
11:04:37.773114 IP (tos 0x0, ttl 64, id 53444, offset 0, flags [DF], proto UDP (17), length 60)
192.168.1.19.44886 > one.one.one.one.domain: [udp sum ok] 55664+ A? www.google.com. (32)
E..<..@.@..0.........V.5.(%>.p...........www.google.com.....
11:04:37.791141 IP (tos 0x0, ttl 59, id 38448, offset 0, flags [DF], proto UDP (17), length 76)
one.one.one.one.domain > 192.168.1.19.59982: [udp sum ok] 40878 q: A? www.google.com. 1/0/0 www.google.com. A 216.58.199.36 (48)
E..L.0@.;............5.N.8C..............www.google.com..................:.$
11:04:37.792747 IP (tos 0x0, ttl 59, id 22750, offset 0, flags [DF], proto UDP (17), length 76)
one.one.one.one.domain > 192.168.1.19.44886: [udp sum ok] 55664 q: A? www.google.com. 1/0/0 www.google.com. A 216.58.199.36 (48)
E..LX.@.;.$..........5.V.8DK.p...........www.google.com..................:.$
11:04:38.611667 IP (tos 0x0, ttl 64, id 53513, offset 0, flags [DF], proto UDP (17), length 61)
192.168.1.19.49761 > one.one.one.one.domain: [udp sum ok] 56769+ A? www.gstatic.com. (33)
E..=. @.@............a.5.)f..............[COLOR="red"]www.gstatic.com[/COLOR].....
11:04:38.634678 IP (tos 0x0, ttl 59, id 49376, offset 0, flags [DF], proto UDP (17), length 77)
one.one.one.one.domain > 192.168.1.19.49761: [udp sum ok] 56769 q: A? www.gstatic.com. 1/0/0 www.gstatic.com. A 172.217.194.94 (49)
E..M..@.;............5.a.9.C.............www.gstatic.com..............
.....^
11:04:39.616555 IP (tos 0x0, ttl 64, id 53773, offset 0, flags [DF], proto UDP (17), length 66)
192.168.1.19.54149 > one.one.one.one.domain: [udp sum ok] 62004+ A? [COLOR="red"]adservice.google.com[/COLOR]. (38)
E..B..@.@..............5.....4.......... adservice.google.com.....
11:04:57.054813 IP (tos 0x0, ttl 64, id 58029, offset 0, flags [DF], proto UDP (17), length 72)
192.168.1.19.7061 > one.one.one.one.domain: [udp sum ok] 20099+ A? [COLOR="red"]encrypted-tbn0.gstatic.com[/COLOR]. (44)
E..H..@.@..;...........5.4..N............encrypted-tbn0.gstatic.com.....
11:04:57.073067 IP (tos 0x0, ttl 59, id 10642, offset 0, flags [DF], proto UDP (17), length 88)
one.one.one.one.domain > 192.168.1.19.7061: [udp sum ok] 20099 q: A? encrypted-tbn0.gstatic.com. 1/0/0 encrypted-tbn0.gstatic.com. A 216.58.199.78 (60)
E..X).@.;.SG.........5...D..N............encrypted-tbn0.gstatic.com..................:.N
11:05:01.738529 IP (tos 0x0, ttl 64, id 58566, offset 0, flags [DF], proto UDP (17), length 64)
192.168.1.19.3008 > one.one.one.one.domain: [udp sum ok] 23720+ A? [COLOR="red"]cdn.ampproject.org[/COLOR]. (36)
E..@..@.@..*...........5.,c.\............cdn
ampproject.org.....
11:05:01.756717 IP (tos 0x0, ttl 59, id 39804, offset 0, flags [DF], proto UDP (17), length 106)
one.one.one.one.domain > 192.168.1.19.3008: [udp sum ok] 23720 q: A? cdn.ampproject.org. 2/0/0 cdn.ampproject.org. CNAME cdn-content.ampproject.org., cdn-content.ampproject.org. A 172.217.25.161 (78)
E..j.|@.;..J.........5...V..\............cdn
ampproject.org.............$....cdn-content...0..............
11:05:05.205234 IP (tos 0x0, ttl 64, id 59239, offset 0, flags [DF], proto UDP (17), length 73)
192.168.1.19.6018 > one.one.one.one.domain: [udp sum ok] 19578+ A? [COLOR="red"]encrypted-vtbn0.gstatic.com[/COLOR]. (45)
E..I.g@.@..............5.5F.Lz...........encrypted-vtbn0.gstatic.com.....
11:05:05.233415 IP (tos 0x0, ttl 59, id 1735, offset 0, flags [DF], proto UDP (17), length 89)
one.one.one.one.domain > 192.168.1.19.6018: [udp sum ok] 19578 q: A? encrypted-vtbn0.gstatic.com. 1/0/0 encrypted-vtbn0.gstatic.com. A 216.58.199.78 (61)
E..Y..@.;.v..........5...Ev.Lz...........encrypted-vtbn0.gstatic.com..................:.N
11:05:09.274483 IP (tos 0x0, ttl 64, id 59973, offset 0, flags [DF], proto UDP (17), length 64)
192.168.1.19.6124 > one.one.one.one.domain: [udp sum ok] 31938+ A? [COLOR="red"]en.m.wikipedia.org[/COLOR]. (36)
E..@.E@.@..............5.,.k|............en.m wikipedia.org.....
11:05:09.293087 IP (tos 0x0, ttl 59, id 42631, offset 0, flags [DF], proto UDP (17), length 80)
one.one.one.one.domain > 192.168.1.19.6124: [udp sum ok] 31938 q: A? en.m.wikipedia.org. 1/0/0 en.m.wikipedia.org. A 103.102.166.224 (52)
E..P..@.;..Y.........5...<.+|............en.m wikipedia.org..............E..gf..
11:05:10.900478 IP (tos 0x0, ttl 64, id 60309, offset 0, flags [DF], proto UDP (17), length 66)
192.168.1.19.33421 > one.one.one.one.domain: [udp sum ok] 16947+ A? [COLOR="red"]upload.wikimedia.org[/COLOR]. (38)
E..B..@.@..Y...........5..@yB3...........upload wikimedia.org.....
11:05:10.925215 IP (tos 0x0, ttl 59, id 25814, offset 0, flags [DF], proto UDP (17), length 82)
one.one.one.one.domain > 192.168.1.19.33421: [udp sum ok] 16947 q: A? upload.wikimedia.org. 1/0/0 upload.wikimedia.org. A 103.102.166.240 (54)
E..Rd.@.;.. .........5...>..B3...........upload wikimedia.org..............T..gf..
11:05:12.418608 IP (tos 0x0, ttl 64, id 60434, offset 0, flags [DF], proto UDP (17), length 65)
192.168.1.19.15197 > one.one.one.one.domain: [udp sum ok] 9859+ A? login.wikimedia.org. (37)
E..A..@.@...........;].5.-..&............login wikimedia.org.....
11:05:12.441287 IP (tos 0x0, ttl 59, id 55602, offset 0, flags [DF], proto UDP (17), length 81)
one.one.one.one.domain > 192.168.1.19.15197: [udp sum ok] 9859 q: A? login.wikimedia.org. 1/0/0 login.wikimedia.org. A 103.102.166.224 (53)
E..Q.2@.;............5;].=.#&............login [COLOR="red"]wikimedia.org[/COLOR].................gf..

Looking at the above, probably could improve it by using a grep to only show the lines with an actual DNS lookup. Maybe a grep on

tcpdump -vvAs0 port 53 | grep "udp sum ok"