| Understanding the DNS Protocol (Part 2) |
|
|
|
| Written by David Noel-Davies | |||||||
| Tuesday, 31 July 2007 | |||||||
|
We are now familiar with the domain name service at a high level. What we now need to do is become familiar with some specifics. To that end we will take a look at about a half dozen or so resource records, and explain what they mean. This will be done with example packets so that we can visualize them, vice simply read about them. The resource records we will cover below are in no specific order. On that note let’s get on with it! Seen in the packets below are various non-routable IP’s, namely 192.168.1.200 and 192.168.1.100, which I put in place to substitute the real IP addresses that were in the packets. Lastly, I have included a selection of both RCODE’s and Resource Records for us to take a look at. With that said let’s take a look at our first packet, which contains an RCODE. There is no such domain!During your everyday surfing of the web it may happen that a link you click on fails to load the requested page. Well, just like in the real world of business, sometimes web sites will disappear for a variety of reasons. Bearing this in mind DNS needs a way of communicating this back to the client that originally made the request. This is done via a DNS RCODE ie: response code known as NX or non-existent domain. It means literally just that, there is no such domain to be found. Please note that I have snipped the below noted packet for brevity, and that in reality the length of the packet should have been 143 bytes as reflected in the “len 143” field highlighted below. So with that said we can see that the DNS server located at 192.168.1.200 is telling 192.168.1.100 (who originally must have asked for DNS resolution on a domain) that the domain it wanted resolution on does not exist. The number that we see below ie: 17165 is the DNS transaction number, and allows the client requesting DNS resolution to keep track of what answer goes with what DNS request. After all, your computer is likely making quite a few DNS resolution requests, and having this number allows it to keep track of what belongs with what.
I want answers!What we see below is an Answer resource record as evidenced by the underlined part seen below. Specifically the “A” corresponds to the “A” resource record. The A record is used to define an IP address. In our case below it is the IP address for the banner.paypopup.com domain. From the below we can deduce once again that 192.168.1.100 issued an “A?” request for the IP address of the banner.paypopup domain. This resource record is very common, and you would indeed see a lot of these were you sniffing your connection while you were surfing. Once again for brevities sake I have snipped part of the packet.
CNAME recordCNAME stands for canonical name, and is also a DNS resource record, much like the A resource record seen above. The CNAME resource record is used to indicate the true host name of a computer. There can however be more then one domain name that is associated with an IP address. In essence a computer can have a whole lot of aliases, which resolve to the one IP address, and that is why the CNAME record is there. The CNAME record must be in the DNS database for each alias.
ServFail RCODEAnother cryptic packet you may encounter is the “ServFail” which is an RCODE just like the NXDomain is. What the ServFail tells you is that there was possibly an error experienced by the DNS server itself, or a timeout occurred during forwarding. This in reality is telling you that it could not honor your DNS request due to a server side issue in all likelihood.
What does a DNS query look like?Well so far we have looked at quite a few DNS responses, and have yet to actually look at a DNS query. Without further ado let’s take a look at what a query looks like. From the underlined portion below we can see the “A?” which means that 192.168.1.200 is asking for an Answer record from 192.168.1.100. In essence he is asking for an IP address for the domain listed after the “A?”. We can see that we have an overall packet length of 61 as evidenced by the “len 61” which is also underlined below. Also we can see that we have thirty three data bytes in the packet as noted in the “(33)” also underlined below. Why is there a disparity between the two numbers you ask? Good question. Well we have an overall packet size of sixty one, and a data payload of thirty three. That makes for a difference of twenty eighty bytes. Where those twenty eight bytes are is twenty bytes for the IP header, and eight bytes for the UDP header. Once we add those in we are able to account for the overall packet size of sixty one.
So we have covered so far several resource records and RCODE’s. This will wrap up part two of the DNS series. In part three we will wrap our coverage of DNS and till then, keep learning!
Powered by !JoomlaComment 3.26
3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved." |
|||||||
| < Prev | Next > |
|---|
