or download this
dual-1-25:~ $ sudo tcpdump -evvv
tcpdump: listening on en0, link-type EN10MB (Ethernet), capture size 9
+6 bytes
...
19:18:22.201699 00:03:93:ab:f2:44 (oui Unknown) > 00:24:01:47:07:41 (o
+ui Unknown), ethertype IPv4 (0x0800), length 84: (tos 0x0, ttl 64, id
+ 7025, offset 0, flags [none], proto UDP (17), length 70) 192.168.1.2
+.52029 > 192.168.1.1.domain: [udp sum ok] 21785+ PTR? 1.1.168.192.in-
+addr.arpa. (42)
19:18:22.242546 00:24:01:47:07:41 (oui Unknown) > 00:03:93:ab:f2:44 (o
+ui Unknown), ethertype IPv4 (0x0800), length 88: (tos 0x0, ttl 248, i
+d 23813, offset 0, flags [DF], proto UDP (17), length 70) 192.168.1.1
+.domain > 192.168.1.2.52029: [udp sum ok] 21785 NXDomain q: PTR? 1.1.
+168.192.in-addr.arpa. 0/0/0 (42)
19:18:27.190310 00:24:01:47:07:41 (oui Unknown) > 00:03:93:ab:f2:44