DNS packets

Paste this command into your terminal:

The password to connect is

Question 1: A closer look at DNS over TCP

Although DNS is mainly used over UDP, there are some situations where it can be used over TCP as well. The attached packet trace contains a TCP connection that was used by dig to interact with the Domain Name System.

Download the packet trace and select the affirmations below that are valid.

If you do not have any packet dissector on your machine, you can visualize the packet trace in the question below.

The query requested an alias (type CNAME)

The packet trace contains one DNS query and one DNS response

The query was sent to an authoritative DNS server.

The query was sent to a DNS resolver.

The response contains a single AAAA record

The query requested an IPv6 address (type AAAA)

Question 2: The packet trace

#	Length	Summary
0	20 bytes	`Transmission Control Protocol, Src Port: 39793, Dst Port: 53, Seq: 0, Len: 0`
1	20 bytes	`Transmission Control Protocol, Src Port: 53, Dst Port: 39793, Seq: 0, Ack: 1, Len: 0`
2	20 bytes	`Transmission Control Protocol, Src Port: 39793, Dst Port: 53, Seq: 1, Ack: 1, Len: 0`
3	80 bytes	`Domain Name System (query)`
4	20 bytes	`Transmission Control Protocol, Src Port: 53, Dst Port: 39793, Seq: 1, Ack: 49, Len: 0`
5	164 bytes	`Domain Name System (response)`
6	20 bytes	`Transmission Control Protocol, Src Port: 39793, Dst Port: 53, Seq: 49, Ack: 133, Len: 0`
7	20 bytes	`Transmission Control Protocol, Src Port: 39793, Dst Port: 53, Seq: 49, Ack: 133, Len: 0`
8	20 bytes	`Transmission Control Protocol, Src Port: 53, Dst Port: 39793, Seq: 133, Ack: 50, Len: 0`
9	20 bytes	`Transmission Control Protocol, Src Port: 39793, Dst Port: 53, Seq: 50, Ack: 134, Len: 0`

0000 9b7100356120043e 00000000a0005f50
0010 13030000

0000 .q.5a .>......_P
0010 ....

Transmission Control Protocol, Src Port: 39793, Dst Port: 53, Seq: 0, Len: 0
- Source Port: 39793
- Destination Port: 53
- TCP Segment Len: 0
- Sequence number: 0 (relative sequence number)
- Acknowledgment number: 0
- 1010 .... = Header Length: 40 bytes (10)
- Window size value: 24400
- Calculated window size: 24400
- Checksum: 0x1303 [unverified]
- Urgent pointer: 0

0000 00359b715317abd2 6120043fa000ffff
0010 a1c80000

0000 .5.qS.«Òa .?..ÿÿ
0010 ¡È..

Transmission Control Protocol, Src Port: 53, Dst Port: 39793, Seq: 0, Ack: 1, Len: 0
- Source Port: 53
- Destination Port: 39793
- TCP Segment Len: 0
- Sequence number: 0 (relative sequence number)
- Acknowledgment number: 1 (relative ack number)
- 1010 .... = Header Length: 40 bytes (10)
- Window size value: 65535
- Calculated window size: 65535
- Checksum: 0xa1c8 [unverified]
- Urgent pointer: 0

0000 9b7100356120043f 5317abd3800000bf
0010 ced40000

0000 .q.5a .?S.«Ó...¿
0010 ÎÔ..

Transmission Control Protocol, Src Port: 39793, Dst Port: 53, Seq: 1, Ack: 1, Len: 0
- Source Port: 39793
- Destination Port: 53
- TCP Segment Len: 0
- Sequence number: 1 (relative sequence number)
- Acknowledgment number: 1 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 191
- Calculated window size: 24448
- Window size scaling factor: 128
- Checksum: 0xced4 [unverified]
- Urgent pointer: 0

0000  9b7100356120043f  5317abd3800000bf
0010  c0ba000000000000  0000000000000000
0020  002ea9be01200001  0000000000000377
0030  777713636f6d7075  7465722d6e657477
0040  6f726b696e670469  6e666f00001c0001

0000  .q.5a .?S.«Ó...¿
0010  Àº..............
0020  ..©¾. .........w
0030  ww.computer-netw
0040  orking.info.....

Transmission Control Protocol, Src Port: 39793, Dst Port: 53, Seq: 1, Ack: 1, Len: 48
- Source Port: 39793
- Destination Port: 53
- TCP Segment Len: 48
- Sequence number: 1 (relative sequence number)
- Acknowledgment number: 1 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 191
- Calculated window size: 24448
- Window size scaling factor: 128
- Checksum: 0xc0ba [unverified]
- Urgent pointer: 0
- TCP payload (48 bytes)
- PDU Size: 48
Domain Name System (query)
- Length: 46
- Transaction ID: 0xa9be
- Flags: 0x0120 Standard query
  - 0... .... .... .... = Response: Message is a query
  - .000 0... .... .... = Opcode: Standard query (0)
  - .... ..0. .... .... = Truncated: Message is not truncated
  - .... ...1 .... .... = Recursion desired: Do query recursively
  - .... .... .0.. .... = Z: reserved (0)
  - .... .... ..1. .... = AD bit: Set
  - .... .... ...0 .... = Non-authenticated data: Unacceptable
- Questions: 1
- Answer RRs: 0
- Authority RRs: 0
- Additional RRs: 0
- Queries
  - www.computer-networking.info: type AAAA, class IN
    - Name: www.computer-networking.info
    - Name Length: 28
    - Label Count: 3
    - Type: AAAA (IPv6 Address) (28)
    - Class: IN (0x0001)

0000 00359b715317abd3 6120046f80000100
0010 ce510000

0000 .5.qS.«Óa .o....
0010 ÎQ..

Transmission Control Protocol, Src Port: 53, Dst Port: 39793, Seq: 1, Ack: 49, Len: 0
- Source Port: 53
- Destination Port: 39793
- TCP Segment Len: 0
- Sequence number: 1 (relative sequence number)
- Acknowledgment number: 49 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 256
- Calculated window size: 65536
- Window size scaling factor: 256
- Checksum: 0xce51 [unverified]
- Urgent pointer: 0

0000  00359b715317abd3  6120046f80000100
0010  58bd000000000000  0000000000000000
0020  0082a9be81800001  0003000000000377
0030  777713636f6d7075  7465722d6e657477
0040  6f726b696e670469  6e666f00001c0001
0050  c00c000500010000  0e0f001908636e70
0060  33626f6f6b04696e  666f0375636c0261
0070  6302626500c03a00  05000100001c1f00
0080  0704636e7033c043  c05f001c00010000
0090  1c1f0010200106a8  308f0008000082ff
00A0  fe68e48c

0000  .5.qS.«Óa .o....
0010  X½..............
0020  ..©¾...........w
0030  ww.computer-netw
0040  orking.info.....
0050  À............cnp
0060  3book.info.ucl.a
0070  c.be.À:.........
0080  ..cnp3ÀCÀ_......
0090  .... ..¨0......ÿ
00A0  þhä.

Transmission Control Protocol, Src Port: 53, Dst Port: 39793, Seq: 1, Ack: 49, Len: 132
- Source Port: 53
- Destination Port: 39793
- TCP Segment Len: 132
- Sequence number: 1 (relative sequence number)
- Acknowledgment number: 49 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 256
- Calculated window size: 65536
- Window size scaling factor: 256
- Checksum: 0x58bd [unverified]
- Urgent pointer: 0
- TCP payload (132 bytes)
- PDU Size: 132
Domain Name System (response)
- Length: 130
- Transaction ID: 0xa9be
- Flags: 0x8180 Standard query response, No error
  - 1... .... .... .... = Response: Message is a response
  - .000 0... .... .... = Opcode: Standard query (0)
  - .... .0.. .... .... = Authoritative: Server is not an authority for domain
  - .... ..0. .... .... = Truncated: Message is not truncated
  - .... ...1 .... .... = Recursion desired: Do query recursively
  - .... .... 1... .... = Recursion available: Server can do recursive queries
  - .... .... .0.. .... = Z: reserved (0)
  - .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
  - .... .... ...0 .... = Non-authenticated data: Unacceptable
  - .... .... .... 0000 = Reply code: No error (0)
- Questions: 1
- Answer RRs: 3
- Authority RRs: 0
- Additional RRs: 0
- Queries
  - www.computer-networking.info: type AAAA, class IN
    - Name: www.computer-networking.info
    - Name Length: 28
    - Label Count: 3
    - Type: AAAA (IPv6 Address) (28)
    - Class: IN (0x0001)
- Answers
  - www.computer-networking.info: type CNAME, class IN, cname cnp3book.info.ucl.ac.be
    - Name: www.computer-networking.info
    - Type: CNAME (Canonical NAME for an alias) (5)
    - Class: IN (0x0001)
    - Time to live: 3599
    - Data length: 25
    - CNAME: cnp3book.info.ucl.ac.be
  - cnp3book.info.ucl.ac.be: type CNAME, class IN, cname cnp3.info.ucl.ac.be
    - Name: cnp3book.info.ucl.ac.be
    - Type: CNAME (Canonical NAME for an alias) (5)
    - Class: IN (0x0001)
    - Time to live: 7199
    - Data length: 7
    - CNAME: cnp3.info.ucl.ac.be
  - cnp3.info.ucl.ac.be: type AAAA, class IN, addr 2001:6a8:308f:8:0:82ff:fe68:e48c
    - Name: cnp3.info.ucl.ac.be
    - Type: AAAA (IPv6 Address) (28)
    - Class: IN (0x0001)
    - Time to live: 7199
    - Data length: 16
    - AAAA Address: 2001:6a8:308f:8:0:82ff:fe68:e48c

0000 9b7100356120046f 5317ac57800000c7
0010 cd3e0000

0000 .q.5a .oS.¬W...Ç
0010 Í>..

Transmission Control Protocol, Src Port: 39793, Dst Port: 53, Seq: 49, Ack: 133, Len: 0
- Source Port: 39793
- Destination Port: 53
- TCP Segment Len: 0
- Sequence number: 49 (relative sequence number)
- Acknowledgment number: 133 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 199
- Calculated window size: 25472
- Window size scaling factor: 128
- Checksum: 0xcd3e [unverified]
- Urgent pointer: 0

0000 9b7100356120046f 5317ac57800000c7
0010 cd3c0000

0000 .q.5a .oS.¬W...Ç
0010 Í<..

Transmission Control Protocol, Src Port: 39793, Dst Port: 53, Seq: 49, Ack: 133, Len: 0
- Source Port: 39793
- Destination Port: 53
- TCP Segment Len: 0
- Sequence number: 49 (relative sequence number)
- Acknowledgment number: 133 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 199
- Calculated window size: 25472
- Window size scaling factor: 128
- Checksum: 0xcd3c [unverified]
- Urgent pointer: 0

0000 00359b715317ac57 6120047080000100
0010 cceb0000

0000 .5.qS.¬Wa .p....
0010 Ìë..

Transmission Control Protocol, Src Port: 53, Dst Port: 39793, Seq: 133, Ack: 50, Len: 0
- Source Port: 53
- Destination Port: 39793
- TCP Segment Len: 0
- Sequence number: 133 (relative sequence number)
- Acknowledgment number: 50 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 256
- Calculated window size: 65536
- Window size scaling factor: 256
- Checksum: 0xcceb [unverified]
- Urgent pointer: 0

0000 9b71003561200470 5317ac58800000c7
0010 cd0e0000

0000 .q.5a .pS.¬X...Ç
0010 Í...

Transmission Control Protocol, Src Port: 39793, Dst Port: 53, Seq: 50, Ack: 134, Len: 0
- Source Port: 39793
- Destination Port: 53
- TCP Segment Len: 0
- Sequence number: 50 (relative sequence number)
- Acknowledgment number: 134 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 199
- Calculated window size: 25472
- Window size scaling factor: 128
- Checksum: 0xcd0e [unverified]
- Urgent pointer: 0

Author(s)	Olivier Bonaventure
Deadline	No deadline
Submission limit	No limitation
Category tags	dns

Information

Tags

Sign in

DNS packets

Question 1: A closer look at DNS over TCP

Question 2: The packet trace

Information

Tags

Sign in

DNS packets Collapse context

Question 1: A closer look at DNS over TCP

Question 2: The packet trace

DNS packets