When DNS is acting weird, you don’t want to scroll through a capture forever. These display filters help you isolate DNS queries, responses, domain lookups, and common failure codes in Wireshark.
What this page covers
Everything here uses display filters (the filter bar in Wireshark). Display filters only change what you see — they don’t change what was captured.
Most used DNS filters:
dns,
dns.flags.response == 0,
dns.flags.response == 1,
dns.qry.name contains "example".
Show DNS traffic
Start here. This shows DNS packets (queries and responses):
dnsDNS queries only
Useful when you want to see what a device is asking for (and whether it’s repeating requests).
dns.flags.response == 0DNS responses only
Helpful when you want to focus on answers coming back from a resolver or DNS server.
dns.flags.response == 1Filter DNS by domain name
This is the fastest way to confirm whether a specific domain was looked up during the capture:
dns.qry.name contains "example"
Replace example with a real domain fragment (like google, microsoft, or your internal hostname).
Filter common DNS errors
If pages won’t load or apps can’t connect, the response code often tells you why. These are the most common:
NXDOMAIN (name doesn’t exist)
The domain or hostname wasn’t found.
dns.flags.rcode == 3SERVFAIL (server failure)
The DNS server couldn’t complete the request.
dns.flags.rcode == 2NOERROR (successful lookup)
The DNS query completed successfully.
dns.flags.rcode == 0A quick DNS troubleshooting workflow
- Filter DNS traffic:
dns - Check if queries exist:
dns.flags.response == 0 - Check if responses exist:
dns.flags.response == 1 - Search for the hostname:
dns.qry.name contains "example" - If responses exist, review the response code:
dns.flags.rcode
If you see repeated queries with no matching response, you may be looking at packet loss, a blocked resolver, or upstream timeout issues.
Download note
If you don’t have Wireshark installed, download it directly from Wireshark.org:
FAQ
What’s the basic Wireshark DNS filter?
Use dns to display DNS traffic in the packet list.
How do I show DNS queries only?
Use dns.flags.response == 0.
How do I find a specific domain lookup?
Use dns.qry.name contains "example" and replace example with your target domain text.