How to view DNS cache in OSX?

Question

To list the entries of DNS cache in OSX 10.11.6, I tried dscacheutil -statistics but that didn't work.

$ sudo dscacheutil -statistics Unable to get details from the cache node 

How can I just print what is there in the DNS cache without flushing it?

Answer 1

mDNSResponder (multicast DNS daemon) SIGINFO signal can dump a snapshot summary of the internal state to /var/log/system.log, including the cache details. To do this:

Keep system log opened in one terminal:

tail -f /private/var/log/system.log 

Send a SIGINFO signal to mDNSResponder from another terminal:

sudo killall -INFO mDNSResponder 

Then check the logs in first terminal, you would be able to see cache dump:

mDNSResponder[98]: ------------ Cache ------------- mDNSResponder[98]: Slt Q     TTL if     U Type rdlen mDNSResponder[98]:  52      1827 -U-      CNAME   17 www.sublimetext.com. CNAME sublimetext.com. ... ... mDNSResponder[98]: Cache currently contains 154 entities; 3 referenced by active questions 

(For more info: man mDNSResponder)

Answer 2

As @PrasseethaKR and @kjagiello point out, on High Siera mDNSResponer has moved from syslog to log. In addition, your DNS lookup messages are now considered private and will show as <private> in both Console and log stream by default.

To view your DNS lookups on High Sierra open an Terminal and run:

sudo log config --mode "private_data:on" log stream --predicate 'process == "mDNSResponder"' --info 

To go back to using private just run the following command.

sudo log config --mode "private_data:off" 

Cheers!