Does anyone know how I might be able to filter DNS requests in tshark which ask for the ANY record?
So far I am able to filter DNS queries with:
tshark -r capture.cap -T fields -e ip.src -e ip.dst -e dns.qry.name -R "dns.flags.response eq 0"
How would I also filter by ANY ?
You would need to filter queries where the QTYPE is * (also known as ANY) (represented by the integer 255):
In WireShark or NetMon this would be
You can find the numerical values for all query types in RFC 1035 §3.2.3 "QTYPE Values"