35

I have seen what the text representation of an HTTP request is, but what does a DNS request look like? Where in the data is the location of the URL you are trying to locate? Also, how is the response formatted?

dionyziz
  • 103
  • 3
AMWJ
  • 353
  • 1
  • 4
  • 6
  • 3
    Your best bet would be to download wireshark and capture the packets you that you can get a full picture of what happens when a DNS request is made. – mrdenny Aug 22 '10 at 06:51
  • 1
    seems like a homework question – Jimsmithkka Aug 22 '10 at 07:35
  • 2
    @mydenny - no, the best bet would be to do that **with a copy of RFC1035** to hand. Wireshark won't give you the "full" picture, it can only ever show you what the particular packets you've seen look like. – Alnitak Aug 23 '10 at 09:00
  • @Jim-It's not @mrdenny-I have used Wireshark and don't know how the raw request translates into what I am sending. – AMWJ Aug 31 '10 at 20:58

4 Answers4

42

This is a raw dump from Wireshark of a DNS query.

The DNS part starts with 24 1a:

0000  00 00 00 00 00 00 00 00  00 00 00 00 08 00 45 00   ........ ......E.
0010  00 3c 51 e3 40 00 40 11  ea cb 7f 00 00 01 7f 00   .<Q.@.@. ........
0020  00 01 ec ed 00 35 00 28  fe 3b 24 1a 01 00 00 01   .....5.( .;$.....
0030  00 00 00 00 00 00 03 77  77 77 06 67 6f 6f 67 6c   .......w ww.googl
0040  65 03 63 6f 6d 00 00 01  00 01                     e.com... ..

And here is the breakdown:

Domain Name System (query)
    [Response In: 1852]
    Transaction ID: 0x241a
    Flags: 0x0100 (Standard query)
        0... .... .... .... = Response: Message is a query
        .000 0... .... .... = Opcode: Standard query (0)
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...1 .... .... = Recursion desired: Do query recursively
        .... .... .0.. .... = Z: reserved (0)
        .... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable
    Questions: 1
    Answer RRs: 0
    Authority RRs: 0
    Additional RRs: 0
    Queries
        www.google.com: type A, class IN
            Name: www.google.com
            Type: A (Host address)
            Class: IN (0x0001)

And the response, again starting at 24 1a:

0000  00 00 00 00 00 00 00 00  00 00 00 00 08 00 45 00   ........ ......E.
0010  00 7a 00 00 40 00 40 11  3c 71 7f 00 00 01 7f 00   .z..@.@. <q......
0020  00 01 00 35 ec ed 00 66  fe 79 24 1a 81 80 00 01   ...5...f .y$.....
0030  00 03 00 00 00 00 03 77  77 77 06 67 6f 6f 67 6c   .......w ww.googl
0040  65 03 63 6f 6d 00 00 01  00 01 c0 0c 00 05 00 01   e.com... ........
0050  00 05 28 39 00 12 03 77  77 77 01 6c 06 67 6f 6f   ..(9...w ww.l.goo
0060  67 6c 65 03 63 6f 6d 00  c0 2c 00 01 00 01 00 00   gle.com. .,......
0070  00 e3 00 04 42 f9 59 63  c0 2c 00 01 00 01 00 00   ....B.Yc .,......
0080  00 e3 00 04 42 f9 59 68                            ....B.Yh

Breakdown:

Domain Name System (response)
    [Request In: 1851]
    [Time: 0.000125000 seconds]
    Transaction ID: 0x241a
    Flags: 0x8180 (Standard query response, No error)
        1... .... .... .... = Response: Message is a response
        .000 0... .... .... = Opcode: Standard query (0)
        .... .0.. .... .... = Authoritative: Server is not an authority for domain
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...1 .... .... = Recursion desired: Do query recursively
        .... .... 1... .... = Recursion available: Server can do recursive queries
        .... .... .0.. .... = Z: reserved (0)
        .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
        .... .... .... 0000 = Reply code: No error (0)
    Questions: 1
    Answer RRs: 3
    Authority RRs: 0
    Additional RRs: 0
    Queries
        www.google.com: type A, class IN
            Name: www.google.com
            Type: A (Host address)
            Class: IN (0x0001)
    Answers
        www.google.com: type CNAME, class IN, cname www.l.google.com
            Name: www.google.com
            Type: CNAME (Canonical name for an alias)
            Class: IN (0x0001)
            Time to live: 3 days, 21 hours, 52 minutes, 57 seconds
            Data length: 18
            Primary name: www.l.google.com
        www.l.google.com: type A, class IN, addr 66.249.89.99
            Name: www.l.google.com
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 3 minutes, 47 seconds
            Data length: 4
            Addr: 66.249.89.99
        www.l.google.com: type A, class IN, addr 66.249.89.104
            Name: www.l.google.com
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 3 minutes, 47 seconds
            Data length: 4
            Addr: 66.249.89.104

Edit:

Note that if your real question is "how do I write a DNS server?", then there are two appropriate answers:

Edit(2):

The request was sent using host on a linux box:

host www.google.com

If you are on Windows, you can use nslookup

nslookup www.google.com
Community
  • 1
ngoozeff
  • 554
  • 5
  • 4
  • 2
    Not upvoting a wire trace without a reference to the real specification. _Far_ too many DNS interop problems have been caused by people believing they can reverse engineer from a wire trace, and missing subtle nuances. In any case this dump is insufficient - it doesn't demonstrate how labels and RRs are encoded. – Alnitak Aug 23 '10 at 08:58
  • 7
    @Alnitak: I read the question as "what is an example of a DNS request/response", rather than what do all possible requests look like. Updated in case that is incorrect. – ngoozeff Aug 23 '10 at 12:48
  • How did you send the request to get this? – AMWJ Aug 31 '10 at 20:59
  • 1
    I would like to know if URL parameters as used in browsers are sent over as well, or is it just the domain name? So for this question, is `/questions/173187/what-does-a-dns-request-look-like` included in the request? – SPRBRN Apr 23 '14 at 07:47
  • 2
    @SPRBRN DNS does not deal with URLs, only domain names. – Håkan Lindqvist Oct 30 '14 at 06:55
  • @SPRBRN The `/questions/173187/what-does-a-dns-request-look-like` part is actually in the HTTP request, not on the DNS one. – Paul Stelian May 19 '18 at 18:28
6

DNS request data layout is described in RFC 1035. I think it's a bit pointless to copy the text here...

Community
  • 1
plaes
  • 327
  • 5
  • 9
6

DNS queries and responses are best looked at using a protocol analyzer - Wireshark is a good cross platform tool that can capture and deconstruct the requests and responses into their various parts. There is a nice introduction to the structure of DNS Requests and Responses at Firewall.cx here.

DNS Requests contain questions that specify a name (or maybe a somewhat arbitrary text field) and a record type - the content of the response will vary depending on the type. Most requests are simple direct lookups of a server name looking for an ip-address in response (Type A) but some will be looking for more information on name servers themselves (Type NS), mail records (Type MX) and other services (Type SRV that will return names, ports, weights and priorities). DNS responses contain answers to these questions, possibly more than one if the request requires that and are not always just ip-addresses.

One other clarification - DNS doesn't resolve URLs - in most scenarios involving URLs DNS is only used to enable the client side system to find the ip-address of the server part of the URL, everything else is handled by other protocols.

Helvick
  • 19,579
  • 4
  • 37
  • 55
4

If you can get onto a Linux machine, you can run the dig command to perform a DNS lookup. This utility performs a lookup and returns exactly what the name server responds with. For example:

; <<>> DiG 9.6.1-P2 <<>> serverfault.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32383
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;serverfault.com.               IN      A

;; ANSWER SECTION:
serverfault.com.        55961   IN      A       69.59.196.211

;; Query time: 21 msec
;; SERVER: 68.87.64.150#53(68.87.64.150)
;; WHEN: Sun Aug 22 09:21:35 2010
;; MSG SIZE  rcvd: 49

Everything starting with the "HEADER" section are what gets returned from the name server. I'm assuming this is what you're referring to as the text format because this isn't the format of the actual packet, but it is the text that gets returned.

Paul Kroon
  • 2,220
  • 16
  • 20