You can do a tcpdump on Port 53
# tcpdump -n -s 1500 -i eth0 udp port 53
Ex:I opened Synaptic Package Manager & clicked on Reload
root@Host-001:/home/oio# tcpdump -n -s 1500 -i eth0 udp port 53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 1500 bytes
17:50:56.418269 IP xxx.x.x.xx.60188 > xx.x.x.x.x: 18737+ A?
archive.gnewsense.org. (39)
17:50:56.418687 IP x.x.x.x.60188 > x.x.x.x.x: 31483+ AAAA?
archive.gnewsense.org. (39)................ect
http://serverfault.com/questions/243877/how-to-monitor-traffic-at-port-53-dns
https://nsrc.org/workshops/2005/pre-SANOG-VI/bc/dns/dns1-02-exercise.html
http://www.binarytides.com/tcpdump-tutorial-sniffing-analysing-packets/
