title: UDP DNS Packet Sniffing
body: <p>So I have used <a href="http://jnetpcap.com/" rel="nofollow">jNetPcap</a> to sniff network packets in one of my projects.
  My question is how do I extract DNS query and response from UDP packets?
  <a href="http://jnetpcap.com/" rel="nofollow">jNetPcap</a> is just a Java wrapper on <code>libpcap</code>, if that helps. </p>
  
  <p>I know to etract DNS packets I need to look at <code>port 53</code>, is it the same for UDP?</p>
  
  <p>I am using something like this currently and then processing the pcap packet:</p>
  
  <pre><code>Pcap pcap = Pcap.openLive(device.getName(), snaplen, flags, timeout, errbuf);
          if (pcap == null) {
              System.err.printf("Error while opening device for capture: " +
                  errbuf.toString());
              return;
          }
          PcapBpfProgram program = new PcapBpfProgram();
      String expression = "udp dst port 53";
      int optimize = 0;         // 0 = false
      int netmask = 0xFFFFFF00; // 255.255.255.0
          if (pcap.compile(program, expression, optimize, netmask) != Pcap.OK) {
              System.err.println(pcap.getErr());
              return;
          }
  
          if (pcap.setFilter(program) != Pcap.OK) {
          System.err.println(pcap.getErr());
          return;     
      }       
      System.out.println("Filter set !!! : " + expression);
  
          // Receive packet from the loop
          PcapPacketHandler&lt;String&gt; jpacketHandler = packet_handler();
  </code></pre>
  
  <p>Any other filter suggestions?</p>
  
  <p>Thanks.</p>