Apply a filter which reads all traffic apart from DNS and TCP using tcpdump

Question

I tried these commands:

1.tcpdump -r bpf-pcap.pcapng -w op2.txt proto not dns and not tcp

2.tcpdump -r bpf-pcap.pcapng -w op2.txt proto not dns and tcp

None of these are correct. I also checked the manual page but couldn't find what's wrong.

What have I missed?

Answer 1

I think you want:

tcpdump -r bpf-pcap.pcapng -w op2.pcap not port 53 and not tcp

Note -w doesn't write a text file but a binary file with the raw packets.