tshark/wireshark cheat sheet

Dump all DNS name lookups  in a pcap along with IP
tshark -r file.cap -T fields -e ip.src -e dns.qry.name -R "dns.flags.response eq 0"