Networking / Beginners

Packet Information

Each DNS packet begins with a session identifier. The query, as well as any responses, uses the same session identifier.

After the identifier, the packet header contains 2 bytes for flags and return codes. The flags specify the type of packet (query or reply), type of query (forward/ standard, reverse/inverse, or status), and whether the information is authoritative. The return code specifies if the query succeeded or failed.

The amount of information in the four data segments varies. A simple query usually has one set of information in the query section and no data in the other three sections. In contrast, a simple reply may repeat the query but will contain information in the answer section. Additional information, such as pointers to authoritative name servers, is included in the remaining two sections.

[Previous] [Contents] [Next]

In this tutorial:

  1. Domain Name System (DNS)
  2. DNS Common Uses
  3. Hostname-to-Address Mapping
  4. Common Lookup Tools
  5. Naming Confusion Attack Vectors
  6. Dotted Names
  7. Name Formatting
  8. Exploited Anonymity
  9. Mail Servers
  10. Sender Policy Framework Overloading
  11. Domain Keys Overloading
  12. DNS Protocol
  13. Packet Information
  14. Simple DNS Server
  15. Distributed Architecture
  16. Top Level Domain Servers
  17. Generic Top Level Domain (gTLD)
  18. Secondary Level Domain (SLD)
  19. Primary and Secondary Servers
  20. Caching Servers
  21. DNS Management
  22. DNS Direct Risks
  23. DNS Performance versus Security
  24. DNS Cache Poisoning
  25. Corrupt DNS Packets
  26. DNS Domain Hijacking
  27. DNS Server Hijacking
  28. Dynamic DNS
  29. Similar Hostnames
  30. Domain Renewals
  31. Hostnames
  32. Zone Transfers
  33. Host Listing
  34. DNS Fields
  35. Mitgation Option
  36. Technical Threat Mitigation
  37. Social Threat Mitigation
  38. Defining Trusted Replies