Which display filter would show only DNS query types?

• A. dns.qry.name
• B. dns.flags.response
• C. dns.qry.class
• D. dns.qry.type

Answer: (D)

In DNS display filters, you target the specific fields inside a DNS message to control what packets you see. The field that indicates what kind of DNS resource record is being requested is the QTYPE, and Wireshark exposes this as dns.qry.type. Filtering on this shows you packets based on the type of record being queried (for example A, AAAA, MX, CNAME, and so on). This is exactly what is meant by “query types.”

The other filters focus on different parts of the DNS message: dns.qry.name filters by the domain name being asked about; dns.flags.response distinguishes between queries and responses; dns.qry.class filters by the DNS class (typically IN). Those don’t target the type of record requested, which is why dns.qry.type is the correct choice for showing DNS query types.

If you want to narrow further, you can specify a specific type, like dns.qry.type == A, to see only A-record queries.