Home / Networking Basics / DNS Wireshark Sample Explained

DNS Wireshark Sample Explained

Here is the setting:

  • Client IP address =
  • DNS server IP address =

Figure: a DNS query Wireshark example

DNS header

The DNS header is the following section in Wireshark:


Figure: DNS header in Wireshark

This is a DNS communication, since the transport protocol is UDP and the destination port is 53:


Figure: UDP port 53

The identification field has the same value for both the DNS query and the DNS response:


Figure: Transaction ID


Figure: Transaction ID in DNS response

The first packet sent is a DNS query:


Figure: DNS query

DNS query message

A DNS query message does not contains an Answer field. It only contains a header and a Question fields.


Figure: DNS question section

The query contains QNAME, QTYPE and QCLASS


Figure: DNS question: QNAME, QTYPE and QCLASS

DNS response message

We see that the DNS response contains both “queries” field and “answers” field. This is as if the DNS server says “hey your question is blablabla, and the answer to it is blablabla”. Also, in the flags field, the Questions flag is activated although this is a DNS response. It’s just a way to tell that this message has answers to a previous question.


Figure: queries and answers fields in the DNS response

Here is an example that shows how ANCOUNT equals the number of answer RRs in the DNS message:


Figure: ANCOUNT and answer RR

DNS response: additional records

Here is an example of the Additional information field of the DNS message. The querying host  asked for an MX record of google.com. The DNS server replied with all the email servers that have the alias hostname of google.com, and as additional information, it gives the name-to-IP address mapping of these email servers in A records (pretty generous):


Figure: DNS query for an MX record


Figure: DNS response containing MX records and additional information in the form of A records





Leave a Reply

Your email address will not be published. Required fields are marked *


Adsense black background: