> dnsdump might be even more evocative . . . "tcpdump" was an appropriate name for that utility about fifteen years ago, but in the time since then i've used it more for non-tcp than for tcp traffic and i mostly don't dump anything i capture it. so, evocative maybe, wrong certainly.