Suppose you want to figure out which DNS server you're using and it is provided via DHCP. This can be surprisingly difficult. Suppose there's:
- Nothing in /etc/resolv.conf
- `dig google.com` shows your machine uses a local DNS server (local dnsmasq)
- /var/lib/dhcp/dhclient.leases looks...wrong
I resorted to:
sudo tcpdump -i eth0 -s0 -n 'udp port 53'
Which is guaranteed to show you what's going on. It turns out network manager stashes leases under its own directory. If you use
ps aux | grep dhclient
you can see network manager running dhclient (perhaps multiple instances per interface) and the -lf (lease file) parameter will point you at something like
/var/lib/NetworkManager/dhclient-[guid].lease
Mystery solved!