Having trouble executing the right command to display DNS (or DNS over HTTPS) traffic

It helps to cross-reference - for others to read and gain context:

No, I think I have one that can cover more...but note:

  • I have no clue what port/protocol your app/phone is using DNS on
  • Neither do you

tcpdump -vvvn -i <bridge_or_WiFi_interface> ether src <MAC_Addess> and ........

Also, if the OP's running:

  • VPNs (e.g. Wireguard, OpenVPN, etc.)
  • Ad/Survey/Usage/Rewards Trackers
  • Tor (e.g. via Orbot app)
  • any app that employs the Android VPN icon

The traffic is being tunneled.

Next...a lot of people keep saying that Android does "this and that" with DNS...from my network analysis (at least on an IPv6 enabled network), my Android devices use the advertised ULA IPv6 DNS address to query my OpenWrt router at 53/udp. I run AdBlock...so I would notice if my Android devices didn't work as intended in regards to my DNS services.