We use dig google.com to find the IP address of google.com, and use wireshark to capture the DNS datagram.
Request
Following is the request data info:
Response
Following is the response data info, header section is somehow different with the request datagram, which is as follows:
There is answer section in response, as follows:
About domain name compression, you can refer #42. Note that the offset in compression(here is 0c in c00c) is started at the very first field in the DNS portion of the packet, which is the transaction ID, and count down 12 bytes.
Ref
RFC 1035
DNS Primer Note
#42
We use
dig google.comto find the IP address of google.com, and use wireshark to capture the DNS datagram.Request
Following is the request data info:
Response
Following is the response data info, header section is somehow different with the request datagram, which is as follows:
There is answer section in response, as follows:
About domain name compression, you can refer #42. Note that the offset in compression(here is 0c in
c00c) is started at the very first field in the DNS portion of the packet, which is the transaction ID, and count down 12 bytes.Ref
RFC 1035
DNS Primer Note
#42