Home / Networking Basics / DNS Wireshark Sample Explained

DNS Wireshark Sample Explained

Here is the setting:

  • Client IP address = 192.168.170.8
  • DNS server IP address = 192.168.170.20
dns-wireshark-example1

Figure: a DNS query Wireshark example

DNS header

The DNS header is the following section in Wireshark:

dns-wireshark-example-dns-header

Figure: DNS header in Wireshark

This is a DNS communication, since the transport protocol is UDP and the destination port is 53:

dns-wireshark-example1port53

Figure: UDP port 53

The identification field has the same value for both the DNS query and the DNS response:

dns-wireshark-example1-ID

Figure: Transaction ID

dns-wireshark-example-ID-in-response

Figure: Transaction ID in DNS response

The first packet sent is a DNS query:

dns-wireshark-example1query

Figure: DNS query

DNS query message

A DNS query message does not contains an Answer field. It only contains a header and a Question fields.

dns-wireshark-example-question-section

Figure: DNS question section

The query contains QNAME, QTYPE and QCLASS

dns-wireshark-example-question-section2

Figure: DNS question: QNAME, QTYPE and QCLASS

DNS response message

We see that the DNS response contains both “queries” field and “answers” field. This is as if the DNS server says “hey your question is blablabla, and the answer to it is blablabla”. Also, in the flags field, the Questions flag is activated although this is a DNS response. It’s just a way to tell that this message has answers to a previous question.

dns-wireshark-example-queries-and-answers1

Figure: queries and answers fields in the DNS response

Here is an example that shows how ANCOUNT equals the number of answer RRs in the DNS message:

dns-wireshark-example-ancount-answer-rr1

Figure: ANCOUNT and answer RR

DNS response: additional records

Here is an example of the Additional information field of the DNS message. The querying host  asked for an MX record of google.com. The DNS server replied with all the email servers that have the alias hostname of google.com, and as additional information, it gives the name-to-IP address mapping of these email servers in A records (pretty generous):

dns-wireshark-example-request-for-mx-record

Figure: DNS query for an MX record

dns-wireshark-example-mx-record-responses-and-a-records

Figure: DNS response containing MX records and additional information in the form of A records

 

References

Wireshark.org

 

Leave a Reply

Your email address will not be published. Required fields are marked *

*

Adsense black background: