1

What does the Flags: 0x0500 section of this DNS query packet mean?

Domain Name System (query)
    Transaction ID: 0x4242
    Flags: 0x0500 Standard query
        0... .... .... .... = Response: Message is a query
        .000 0... .... .... = Opcode: Standard query (0)
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...1 .... .... = Recursion desired: Do query recursively
        .... .... .0.. .... = Z: reserved (0)
        .... .... ...0 .... = Non-authenticated data: Unacceptable
    Questions: 1
    Answer RRs: 0
    Authority RRs: 0
    Additional RRs: 0
    Queries
        secure.net: type A, class IN

This packet seems abnormal as this section would normally be Flags: 0x0100. What is the relevance of this section?

Justin
  • 13
  • 3

2 Answers2

1

Those flags are described in RFC 1035 section 4.1.1. THe bit you have set, to get 0x0500 is this

AA Authoritative Answer - this bit is valid in responses, and specifies that the responding name server is an authority for the domain name in question section.

Community
  • 1
Eduardo Trápani
  • 1,140
  • 6
  • 10
0

For any reason, Wireshark is not showing the AA (Authoritative Answer) flag, which is enabled in your example.

On my Wireshark that flag is showed:

Flags: 0x8180 Standard query response, No error
    1... .... .... .... = Response: Message is a response
    .000 0... .... .... = Opcode: Standard query (0)
    .... .0.. .... .... = Authoritative: Server is not an authority for domain
    .... ..0. .... .... = Truncated: Message is not truncated
    .... ...1 .... .... = Recursion desired: Do query recursively
    .... .... 1... .... = Recursion available: Server can do recursive queries
    .... .... .0.. .... = Z: reserved (0)
    .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
    .... .... ...0 .... = Non-authenticated data: Unacceptable
    .... .... .... 0000 = Reply code: No error (0)
pbacterio
  • 276
  • 2
  • 6