tshark

Wireshark CLI.

$ sudo tshark -i any -f 'port 53'
$ tshark -r capture.pcap -Y 'http.request' -T fields -e http.host