I'm afraid Sir you are missing the point. - You can not generate BPF that matches DNS queries to "*.example.uk" with tcpdump. - It's hard to produce BPF that

I'm afraid Sir you are missing the point. - You can not generate BPF that matches DNS queries to "*.example.uk" with tcpdump. - It's hard to produce BPF that is usable by xt_bpf with tcpdump. - There are many tools that parse DNS requests, true. We just wanted to have a nice, flat, self contained script, without too many abstractions to allow us to experiment rapidly with different ways of matching the traffic.