I want to know how often my router accesses the manufacturer's support site over an extended length of time (several days). The support site changes IP address frequently, so my thought is to capture every time the router does a DNS request and gets a response. I know that DNS is port 53 and the responder is CloudFlare (1.1.1.1), but I want to capture only the responses that give the IP of "http.fw.updates1.netgear.com", not the thousands of DNS responses generated by all the other network activity (web, email, streaming, etc.) What I cannot figure out is a filter to capture only the DNS responses I want.
If that is simply not possible, I can capture all DNS responses, but I need to create a Display filter to pick out the relevant packets.
Looking for suggestions. Thanks.