hablet@ubuntu-phablet:~$ sudo tcpdump -vvv -s 0 -l -n port 53
tcpdump: listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes
17:52:58.443493 IP6 (hlim 64, next-header UDP (17) payload length: 36) fe80::ba64:91ff:fe47:72c6.12227 > 2001:67c:1560:a003::1.53: [udp sum ok] 53833+ A? google.com. (28)
17:52:58.443617 IP (tos 0x0, ttl 64, id 20303, offset 0, flags [DF], proto UDP (17), length 56)
    10.20.66.252.11609 > 10.20.64.1.53: [bad udp cksum 0x975a -> 0x54f0!] 53833+ A? google.com. (28)
17:52:58.459997 IP6 (hlim 64, next-header UDP (17) payload length: 36) 2001:67c:1560:a003::1.53 > fe80::ba64:91ff:fe47:72c6.12227: [udp sum ok] 53833 Refused- q: A? google.com. 0/0/0 (28)
17:52:58.460345 IP (tos 0x0, ttl 64, id 14301, offset 0, flags [none], proto UDP (17), length 144)
    10.20.64.1.53 > 10.20.66.252.11609: [udp sum ok] 53833 q: A? google.com. 1/4/0 google.com. [49s] A 216.58.213.78 ns: google.com. [1d14h34m30s] NS ns1.google.com., google.com. [1d14h34m30s] NS ns2.google.com., google.com. [1d14h34m30s] NS ns3.google.com., google.com. [1d14h34m30s] NS ns4.google.com. (116)
17:52:58.460918 IP6 (hlim 64, next-header UDP (17) payload length: 36) fe80::ba64:91ff:fe47:72c6.58396 > 2001:67c:1560:a003::1.53: [udp sum ok] 43400+ A? google.com. (28)
17:52:58.461007 IP (tos 0x0, ttl 64, id 20305, offset 0, flags [DF], proto UDP (17), length 56)
    10.20.66.252.11194 > 10.20.64.1.53: [bad udp cksum 0x975a -> 0x7f50!] 43400+ A? google.com. (28)
17:52:58.461946 IP6 (hlim 64, next-header UDP (17) payload length: 36) 2001:67c:1560:a003::1.53 > fe80::ba64:91ff:fe47:72c6.58396: [udp sum ok] 43400 Refused- q: A? google.com. 0/0/0 (28)
17:52:58.462538 IP6 (hlim 64, next-header UDP (17) payload length: 44) fe80::ba64:91ff:fe47:72c6.6437 > 2001:67c:1560:a003::1.53: [udp sum ok] 18062+ A? google.com.bluefin. (36)
17:52:58.462626 IP (tos 0x0, ttl 64, id 20306, offset 0, flags [DF], proto UDP (17), length 64)
    10.20.66.252.38700 > 10.20.64.1.53: [bad udp cksum 0x9762 -> 0xca85!] 18062+ A? google.com.bluefin. (36)
17:52:58.462747 IP (tos 0x0, ttl 64, id 14302, offset 0, flags [none], proto UDP (17), length 144)
    10.20.64.1.53 > 10.20.66.252.11194: [udp sum ok] 43400 q: A? google.com. 1/4/0 google.com. [49s] A 216.58.213.78 ns: google.com. [1d14h34m30s] NS ns3.google.com., google.com. [1d14h34m30s] NS ns4.google.com., google.com. [1d14h34m30s] NS ns2.google.com., google.com. [1d14h34m30s] NS ns1.google.com. (116)
17:52:58.463966 IP6 (hlim 64, next-header UDP (17) payload length: 44) 2001:67c:1560:a003::1.53 > fe80::ba64:91ff:fe47:72c6.6437: [udp sum ok] 18062 Refused- q: A? google.com.bluefin. 0/0/0 (36)
17:52:58.464369 IP (tos 0x0, ttl 64, id 14303, offset 0, flags [none], proto UDP (17), length 131)
    10.20.64.1.53 > 10.20.66.252.38700: [udp sum ok] 18062 NXDomain* q: A? google.com.bluefin. 0/1/0 ns: bluefin. [1h] SOA habrok.bluefin. hostmaster.canonical.com. 8 10800 3600 604800 3600 (103)
17:52:58.464622 IP6 (hlim 64, next-header UDP (17) payload length: 44) fe80::ba64:91ff:fe47:72c6.10461 > 2001:67c:1560:a003::1.53: [udp sum ok] 50755+ A? google.com.bluefin. (36)
17:52:58.464697 IP (tos 0x0, ttl 64, id 20309, offset 0, flags [DF], proto UDP (17), length 64)
    10.20.66.252.28904 > 10.20.64.1.53: [bad udp cksum 0x9762 -> 0x7114!] 50755+ A? google.com.bluefin. (36)
17:52:58.465911 IP6 (hlim 64, next-header UDP (17) payload length: 44) 2001:67c:1560:a003::1.53 > fe80::ba64:91ff:fe47:72c6.10461: [udp sum ok] 50755 Refused- q: A? google.com.bluefin. 0/0/0 (36)
17:52:58.467360 IP (tos 0x0, ttl 64, id 14304, offset 0, flags [none], proto UDP (17), length 131)
    10.20.64.1.53 > 10.20.66.252.28904: [udp sum ok] 50755 NXDomain* q: A? google.com.bluefin. 0/1/0 ns: bluefin. [1h] SOA habrok.bluefin. hostmaster.canonical.com. 8 10800 3600 604800 3600 (103)