DNS can also be used over TCP instead of UDP. In this case, several requests and responses can be sent over the bytestream. The transaction identifier is still used to identify the response that matches a request. The only difference with DNS over UDP is that each DNS message is prefixed with a length field that contains the length of the DNS message. Can you infer the value of this length field in the attached TCP trace ?
| # |
Length |
Summary |
Status |
| 0 |
40 bytes |
Transmission Control Protocol, Src Port: 44401, Dst Port: 53, Seq: 0, Len: 0 |
|
| 1 |
40 bytes |
Transmission Control Protocol, Src Port: 53, Dst Port: 44401, Seq: 0, Ack: 1, Len: 0 |
|
| 2 |
32 bytes |
Transmission Control Protocol, Src Port: 44401, Dst Port: 53, Seq: 1, Ack: 1, Len: 0 |
|
| 3 |
76 bytes |
Domain Name System (query) |
|
| 4 |
32 bytes |
Transmission Control Protocol, Src Port: 53, Dst Port: 44401, Seq: 1, Ack: 45, Len: 0 |
|
| 5 |
122 bytes |
Domain Name System (response) |
|
| 6 |
32 bytes |
Transmission Control Protocol, Src Port: 44401, Dst Port: 53, Seq: 45, Ack: 91, Len: 0 |
|
| 7 |
32 bytes |
Transmission Control Protocol, Src Port: 44401, Dst Port: 53, Seq: 45, Ack: 91, Len: 0 |
|
| 8 |
32 bytes |
Transmission Control Protocol, Src Port: 53, Dst Port: 44401, Seq: 91, Ack: 46, Len: 0 |
|
| 9 |
32 bytes |
Transmission Control Protocol, Src Port: 44401, Dst Port: 53, Seq: 46, Ack: 92, Len: 0 |
|
0000 ad710035fdf48918 00000000a0025f50
0010 727a0000020404c4 0402080aa08a9ca0
0020 0000000001030307
0000 .q.5ýô........_P
0010 rz.....Ä........
0020 ........
- Transmission Control Protocol, Src Port: 44401, Dst Port: 53, Seq: 0, Len: 0
- Source Port: 44401
- Destination Port: 53
- TCP Segment Len: 0
- Sequence number: 0 (relative sequence number)
- Acknowledgment number: 0
- 1010 .... = Header Length: 40 bytes (10)
- Flags: 0x002 (SYN)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...0 .... = Acknowledgment: Not set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..1. = Syn: Set
- .... .... ...0 = Fin: Not set
- TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7S\xc2\xb7
- Window size value: 24400
- Calculated window size: 24400
- Checksum: 0x727a [unverified]
- Urgent pointer: 0
- Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
- TCP Option - Maximum segment size: 1220 bytes
- Kind: Maximum Segment Size (2)
- Length: 4
- MSS Value: 1220
- TCP Option - SACK permitted
- Kind: SACK Permitted (4)
- Length: 2
- TCP Option - Timestamps: TSval 2693438624, TSecr 0
- Kind: Time Stamp Option (8)
- Length: 10
- Timestamp value: 2693438624
- Timestamp echo reply: 0
- TCP Option - No-Operation (NOP)
- TCP Option - Window scale: 7 (multiply by 128)
- Kind: Window Scale (3)
- Length: 3
- Shift count: 7
- Multiplier: 128
0000 0035ad717fd81516 fdf48919a012ffff
0010 e159000002040550 0402080af456f987
0020 a08a9ca001030308
0000 .5.q.Ø..ýô....ÿÿ
0010 áY.....P....ôVù.
0020 ........
- Transmission Control Protocol, Src Port: 53, Dst Port: 44401, Seq: 0, Ack: 1, Len: 0
- Source Port: 53
- Destination Port: 44401
- TCP Segment Len: 0
- Sequence number: 0 (relative sequence number)
- Acknowledgment number: 1 (relative ack number)
- 1010 .... = Header Length: 40 bytes (10)
- Flags: 0x012 (SYN, ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgment: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..1. = Syn: Set
- .... .... ...0 = Fin: Not set
- TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7A\xc2\xb7\xc2\xb7S\xc2\xb7
- Window size value: 65535
- Calculated window size: 65535
- Checksum: 0xe159 [unverified]
- Urgent pointer: 0
- Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
- TCP Option - Maximum segment size: 1360 bytes
- Kind: Maximum Segment Size (2)
- Length: 4
- MSS Value: 1360
- TCP Option - SACK permitted
- Kind: SACK Permitted (4)
- Length: 2
- TCP Option - Timestamps: TSval 4099340679, TSecr 2693438624
- Kind: Time Stamp Option (8)
- Length: 10
- Timestamp value: 4099340679
- Timestamp echo reply: 2693438624
- TCP Option - No-Operation (NOP)
- TCP Option - Window scale: 8 (multiply by 256)
- Kind: Window Scale (3)
- Length: 3
- Shift count: 8
- Multiplier: 256
0000 ad710035fdf48919 7fd81517801000bf
0010 727200000101080a a08a9cb9f456f987
0000 .q.5ýô...Ø.....¿
0010 rr.........¹ôVù.
- Transmission Control Protocol, Src Port: 44401, Dst Port: 53, Seq: 1, Ack: 1, Len: 0
- Source Port: 44401
- Destination Port: 53
- TCP Segment Len: 0
- Sequence number: 1 (relative sequence number)
- Acknowledgment number: 1 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Flags: 0x010 (ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgment: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7A\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7
- Window size value: 191
- Calculated window size: 24448
- Window size scaling factor: 128
- Checksum: 0x7272 [unverified]
- Urgent pointer: 0
- Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
- TCP Option - No-Operation (NOP)
- TCP Option - No-Operation (NOP)
- TCP Option - Timestamps: TSval 2693438649, TSecr 4099340679
- Kind: Time Stamp Option (8)
- Length: 10
- Timestamp value: 2693438649
- Timestamp echo reply: 4099340679
0000 ad710035fdf48919 7fd81517801800bf
0010 729e00000101080a a08a9cb9f456f987
0020 ????ec2001200001 0000000000001363
0030 6f6d70757465722d 6e6574776f726b69
0040 6e6704696e666f00 00020001
0000 .q.5ýô...Ø.....¿
0010 r..........¹ôVù.
0020 ??ì . .........c
0030 omputer-networki
0040 ng.info.....
- Transmission Control Protocol, Src Port: 44401, Dst Port: 53, Seq: 1, Ack: 1, Len: 44
- Source Port: 44401
- Destination Port: 53
- TCP Segment Len: 44
- Sequence number: 1 (relative sequence number)
- Acknowledgment number: 1 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Flags: 0x018 (PSH, ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgment: Set
- .... .... 1... = Push: Set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7AP\xc2\xb7\xc2\xb7\xc2\xb7
- Window size value: 191
- Calculated window size: 24448
- Window size scaling factor: 128
- Checksum: 0x729e [unverified]
- Urgent pointer: 0
- Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
- TCP Option - No-Operation (NOP)
- TCP Option - No-Operation (NOP)
- TCP Option - Timestamps: TSval 2693438649, TSecr 4099340679
- Kind: Time Stamp Option (8)
- Length: 10
- Timestamp value: 2693438649
- Timestamp echo reply: 4099340679
- TCP payload (44 bytes)
- PDU Size: 44
- Domain Name System (query)
0000 0035ad717fd81517 fdf4894580100100
0010 0e6200000101080a f456f9a3a08a9cb9
0000 .5.q.Ø..ýô.E....
0010 .b......ôVù£...¹
- Transmission Control Protocol, Src Port: 53, Dst Port: 44401, Seq: 1, Ack: 45, Len: 0
- Source Port: 53
- Destination Port: 44401
- TCP Segment Len: 0
- Sequence number: 1 (relative sequence number)
- Acknowledgment number: 45 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Flags: 0x010 (ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgment: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7A\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7
- Window size value: 256
- Calculated window size: 65536
- Window size scaling factor: 256
- Checksum: 0x0e62 [unverified]
- Urgent pointer: 0
- Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
- TCP Option - No-Operation (NOP)
- TCP Option - No-Operation (NOP)
- TCP Option - Timestamps: TSval 4099340707, TSecr 2693438649
- Kind: Time Stamp Option (8)
- Length: 10
- Timestamp value: 4099340707
- Timestamp echo reply: 2693438649
0000 0035ad717fd81517 fdf4894580180100
0010 fb8f00000101080a f456f9aaa08a9cb9
0020 ????ec2081a00001 0002000000001363
0030 6f6d70757465722d 6e6574776f726b69
0040 6e6704696e666f00 00020001c00c0002
0050 000100000dee000f 05646e733230036f
0060 7668036e657400c0 0c0002000100000d
0070 ee0007046e733230 c03c
0000 .5.q.Ø..ýô.E....
0010 û.......ôVùª...¹
0020 ??ì ...........c
0030 omputer-networki
0040 ng.info.....À...
0050 .....î...dns20.o
0060 vh.net.À........
0070 î...ns20À<
- Transmission Control Protocol, Src Port: 53, Dst Port: 44401, Seq: 1, Ack: 45, Len: 90
- Source Port: 53
- Destination Port: 44401
- TCP Segment Len: 90
- Sequence number: 1 (relative sequence number)
- Acknowledgment number: 45 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Flags: 0x018 (PSH, ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgment: Set
- .... .... 1... = Push: Set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7AP\xc2\xb7\xc2\xb7\xc2\xb7
- Window size value: 256
- Calculated window size: 65536
- Window size scaling factor: 256
- Checksum: 0xfb8f [unverified]
- Urgent pointer: 0
- Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
- TCP Option - No-Operation (NOP)
- TCP Option - No-Operation (NOP)
- TCP Option - Timestamps: TSval 4099340714, TSecr 2693438649
- Kind: Time Stamp Option (8)
- Length: 10
- Timestamp value: 4099340714
- Timestamp echo reply: 2693438649
- TCP payload (90 bytes)
- PDU Size: 90
- Domain Name System (response)
0000 ad710035fdf48945 7fd81571801000bf
0010 727200000101080a a08a9cdcf456f9aa
0000 .q.5ýô.E.Ø.q...¿
0010 rr.........ÜôVùª
- Transmission Control Protocol, Src Port: 44401, Dst Port: 53, Seq: 45, Ack: 91, Len: 0
- Source Port: 44401
- Destination Port: 53
- TCP Segment Len: 0
- Sequence number: 45 (relative sequence number)
- Acknowledgment number: 91 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Flags: 0x010 (ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgment: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7A\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7
- Window size value: 191
- Calculated window size: 24448
- Window size scaling factor: 128
- Checksum: 0x7272 [unverified]
- Urgent pointer: 0
- Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
- TCP Option - No-Operation (NOP)
- TCP Option - No-Operation (NOP)
- TCP Option - Timestamps: TSval 2693438684, TSecr 4099340714
- Kind: Time Stamp Option (8)
- Length: 10
- Timestamp value: 2693438684
- Timestamp echo reply: 4099340714
0000 ad710035fdf48945 7fd81571801100bf
0010 727200000101080a a08a9cddf456f9aa
0000 .q.5ýô.E.Ø.q...¿
0010 rr.........ÝôVùª
- Transmission Control Protocol, Src Port: 44401, Dst Port: 53, Seq: 45, Ack: 91, Len: 0
- Source Port: 44401
- Destination Port: 53
- TCP Segment Len: 0
- Sequence number: 45 (relative sequence number)
- Acknowledgment number: 91 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Flags: 0x011 (FIN, ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgment: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...1 = Fin: Set
- TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7A\xc2\xb7\xc2\xb7\xc2\xb7F
- Window size value: 191
- Calculated window size: 24448
- Window size scaling factor: 128
- Checksum: 0x7272 [unverified]
- Urgent pointer: 0
- Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
- TCP Option - No-Operation (NOP)
- TCP Option - No-Operation (NOP)
- TCP Option - Timestamps: TSval 2693438685, TSecr 4099340714
- Kind: Time Stamp Option (8)
- Length: 10
- Timestamp value: 2693438685
- Timestamp echo reply: 4099340714
0000 0035ad717fd81571 fdf4894680110100
0010 0dbe00000101080a f456f9c7a08a9cdd
0000 .5.q.Ø.qýô.F....
0010 .¾......ôVùÇ...Ý
- Transmission Control Protocol, Src Port: 53, Dst Port: 44401, Seq: 91, Ack: 46, Len: 0
- Source Port: 53
- Destination Port: 44401
- TCP Segment Len: 0
- Sequence number: 91 (relative sequence number)
- Acknowledgment number: 46 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Flags: 0x011 (FIN, ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgment: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...1 = Fin: Set
- TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7A\xc2\xb7\xc2\xb7\xc2\xb7F
- Window size value: 256
- Calculated window size: 65536
- Window size scaling factor: 256
- Checksum: 0x0dbe [unverified]
- Urgent pointer: 0
- Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
- TCP Option - No-Operation (NOP)
- TCP Option - No-Operation (NOP)
- TCP Option - Timestamps: TSval 4099340743, TSecr 2693438685
- Kind: Time Stamp Option (8)
- Length: 10
- Timestamp value: 4099340743
- Timestamp echo reply: 2693438685
0000 ad710035fdf48946 7fd81572801000bf
0010 727200000101080a a08a9cf9f456f9c7
0000 .q.5ýô.F.Ø.r...¿
0010 rr.........ùôVùÇ
- Transmission Control Protocol, Src Port: 44401, Dst Port: 53, Seq: 46, Ack: 92, Len: 0
- Source Port: 44401
- Destination Port: 53
- TCP Segment Len: 0
- Sequence number: 46 (relative sequence number)
- Acknowledgment number: 92 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Flags: 0x010 (ACK)
- 000. .... .... = Reserved: Not set
- ...0 .... .... = Nonce: Not set
- .... 0... .... = Congestion Window Reduced (CWR): Not set
- .... .0.. .... = ECN-Echo: Not set
- .... ..0. .... = Urgent: Not set
- .... ...1 .... = Acknowledgment: Set
- .... .... 0... = Push: Not set
- .... .... .0.. = Reset: Not set
- .... .... ..0. = Syn: Not set
- .... .... ...0 = Fin: Not set
- TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7A\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7
- Window size value: 191
- Calculated window size: 24448
- Window size scaling factor: 128
- Checksum: 0x7272 [unverified]
- Urgent pointer: 0
- Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
- TCP Option - No-Operation (NOP)
- TCP Option - No-Operation (NOP)
- TCP Option - Timestamps: TSval 2693438713, TSecr 4099340743
- Kind: Time Stamp Option (8)
- Length: 10
- Timestamp value: 2693438713
- Timestamp echo reply: 4099340743