my %com = qw( a.gtld-servers.net. 192.5.6.30 b.gtld-servers.net. 192.33.14.30 c.gtld-servers.net. 192.26.92.30 d.gtld-servers.net. 192.31.80.30 e.gtld-servers.net. 192.12.94.30 f.gtld-servers.net. 192.35.51.30 g.gtld-servers.net. 192.42.93.30 h.gtld-servers.net. 192.54.112.30 i.gtld-servers.net. 192.43.172.30 j.gtld-servers.net. 192.48.79.30 k.gtld-servers.net. 192.52.178.30 l.gtld-servers.net. 192.41.162.30 m.gtld-servers.net. 192.55.83.30 ); my %net = qw( a.gtld-servers.net. 192.5.6.30 b.gtld-servers.net. 192.33.14.30 c.gtld-servers.net. 192.26.92.30 d.gtld-servers.net. 192.31.80.30 e.gtld-servers.net. 192.12.94.30 f.gtld-servers.net. 192.35.51.30 g.gtld-servers.net. 192.42.93.30 h.gtld-servers.net. 192.54.112.30 i.gtld-servers.net. 192.43.172.30 j.gtld-servers.net. 192.48.79.30 k.gtld-servers.net. 192.52.178.30 l.gtld-servers.net. 192.41.162.30 m.gtld-servers.net. 192.55.83.30 ); my %biz = qw( a.gtld.biz. 209.173.53.162 b.gtld.biz. 209.173.57.162 c.gtld.biz. 209.173.60.65 d.gtld.biz. 213.86.51.129 e.gtld.biz. 209.173.58.65 f.gtld.biz. 209.173.58.66 g.gtld.biz. 199.7.64.126 h.gtld.biz. 199.7.77.126 ); # ipv6 only server!!! # j.gtld.biz. my %us = qw( a.gtld.biz. 209.173.53.162 b.gtld.biz. 209.173.57.162 c.gtld.biz. 209.173.60.65 i.gtld.biz. 156.154.96.126 k.gtld.biz. 156.154.72.65 ); my %info = qw( a9.info.afilias-nst.info 204.74.112.33 b9.info.afilias-nst.info 204.74.113.33 c9.info.afilias-nst.info 199.7.66.33 d9.info.afilias-nst.info 199.7.67.33 e9.info.afilias-nst.info 192.100.59.33 f9.info.afilias-nst.info 198.133.199.33 ); my %servers; @servers{values %info, values %us, values %biz, values %net, values %com} = 1; my $servers = join(" or ", keys %servers); Net::Pcap::compile($pcap, \$filter, "udp port 53 and (host ($servers))", 0, "255.255.255.0");