Lesson Contents
This packet capture contains one DNS lookup: a client asks its DNS server for the IPv4 address (A record) of cisco.com, and the server answers 27 milliseconds later. Two packets, but they show everything a DNS message is made of: the transaction ID that ties the answer to the question, the flags that ask for and offer recursion, and four sections (question, answer, authority, additional). The 545-byte response also shows why DNS needs name compression.
The introduction to DNS lesson explains how resolvers, root servers and TLD servers work together to answer a query like this one. More captures are in the Packet Capture Library.
Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.
Create a free account to download the pcap
Already have an account? Log in and the download button appears here.
Capture overview
| File | dns-request-reply.pcapng |
| Packets | 2 (query, response) |
| Protocol | DNS (RFC 1035) |
| Transport | UDP: client port 52117 → server port 53 |
| Devices | Client 10.82.100.134, DNS server 10.82.100.253 |
| Wireshark filter | dns or dns.qry.name == "cisco.com" |
Packets in this capture
No. Time Source Destination Length Info
1 0.000000 10.82.100.134 10.82.100.253 69 Standard query 0x859b A cisco.com
2 0.026956 10.82.100.253 10.82.100.134 545 Standard query response 0x859b A cisco.com A 72.163.4.161 NS l.gtld-servers.net ...Packet walkthrough
Query (packet 1)
User Datagram Protocol, Src Port: 52117, Dst Port: 53
Domain Name System (query)
Transaction ID: 0x859b
Flags: 0x0100 Standard query
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...1 .... .... = Recursion desired: Do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...0 .... = Non-authenticated data: Unacceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 0
Queries
cisco.com: type A, class IN
Name: cisco.com
Type: A (1) (Host Address)
Class: IN (0x0001)- UDP port 53: DNS servers listen on port 53. The client picks a random source port (52117). Together with the transaction ID, the random port makes it harder for an attacker to spoof a response.
- Transaction ID 0x859b: a 16-bit number the client picks. The server copies it into the response, so the client can match the answer to the question.
- Response bit 0: this message is a query. Queries and responses use the same header, and this bit tells them apart.
- Recursion desired (RD): the client asks the server to do all the work: contact the root, TLD and authoritative servers if needed, and return the final answer. Clients (stub resolvers) almost always set this bit.
- One question, type A, class IN: “what is the IPv4 address of cisco.com?” An IPv6 lookup would ask for type AAAA (28). The three other section counters are zero: a query has no answers. Many modern clients add one additional record, the EDNS(0) OPT record, but this one doesn’t.
Response (packet 2)
User Datagram Protocol, Src Port: 53, Dst Port: 52117
Length: 511
Domain Name System (response)
Transaction ID: 0x859b
Flags: 0x8180 Standard query response, No error
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...1 .... .... = Recursion desired: Do query recursively
.... .... 1... .... = Recursion available: Server can do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... ...0 .... = Non-authenticated data: Unacceptable
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 1
Authority RRs: 13
Additional RRs: 14
Queries
cisco.com: type A, class IN
Name: cisco.com
Type: A (1) (Host Address)
Class: IN (0x0001)
Answers
cisco.com: type A, class IN, addr 72.163.4.161
Name: cisco.com
Type: A (1) (Host Address)
Class: IN (0x0001)
Time to live: 19057 (5 hours, 17 minutes, 37 seconds)
Data length: 4
Address: 72.163.4.161
Authoritative nameservers
com: type NS, class IN, ns l.gtld-servers.net
Name: com
Type: NS (2) (authoritative Name Server)
Class: IN (0x0001)
Time to live: 46224 (12 hours, 50 minutes, 24 seconds)
Data length: 20
Name Server: l.gtld-servers.net
com: type NS, class IN, ns i.gtld-servers.net
Name: com
Type: NS (2) (authoritative Name Server)
Class: IN (0x0001)
Time to live: 46224 (12 hours, 50 minutes, 24 seconds)
Data length: 4
Name Server: i.gtld-servers.net
(11 more NS records for a-m.gtld-servers.net)
Additional records
a.gtld-servers.net: type A, class IN, addr 192.5.6.30
a.gtld-servers.net: type AAAA, class IN, addr 2001:503:a83e::2:30
b.gtld-servers.net: type A, class IN, addr 192.33.14.30
(11 more A records for c-m.gtld-servers.net)- Same transaction ID 0x859b, with the response bit set.
- Authoritative: not set: this server isn’t responsible for cisco.com. It’s a recursive resolver that looked up (or had cached) the answer. Only a response from cisco.com’s own name servers would have the AA bit set.
- Recursion available (RA): the server confirms it does recursive lookups.
- Reply code 0 (No error): the name exists and the server found an answer. If cisco.com didn’t exist, you’d see reply code 3 (NXDOMAIN), and a server problem would show up as 2 (SERVFAIL).
- Answer: 72.163.4.161, TTL 19057: the client may cache this address for another 5 hours and 17 minutes. The TTL is a countdown: a caching resolver hands out the remaining time, not the original TTL.
- Authority: 13 NS records: the name servers for the .com zone, a.gtld-servers.net through m.gtld-servers.net. The resolver included them with the answer. The client doesn’t need them to reach cisco.com.
- Additional: 14 records: the IPv4 (and one IPv6) addresses of those name servers. The server adds them to the additional section to save a lookup: whoever wants to ask a .com server already has its address.
Name compression
Look at the data length of the first two NS records. The first one is 20 bytes: it spells out “l.gtld-servers.net” in full. The second one, “i.gtld-servers.net”, is only 4 bytes. DNS name compression replaces a repeated part of a name with a 2-byte pointer to where that part already appears in the message. So the second record only carries “i” plus a pointer to “.gtld-servers.net”.
Without compression, these 27 records would be much larger. Classic DNS over UDP is limited to 512 bytes of DNS data. This response carries 503 bytes (the UDP length of 511 minus 8 bytes of UDP header), just under that limit. For bigger responses, the client can use EDNS(0) to advertise a larger UDP buffer size in its query. Otherwise, the response comes back with the truncated (TC) bit set, and the client retries over TCP port 53.