Analysis of DNS Protocol Using Wireshark
Experiment
Analysis of DNS Protocol Using Wireshark
Aim
To capture and analyze DNS (Domain Name System) packets using Wireshark and understand the DNS name resolution process between a client and a DNS server.
Objectives
After completing this experiment, students will be able to:
- Understand the purpose and operation of the Domain Name System (DNS).
- Capture DNS packets using Wireshark.
- Apply DNS display filters in Wireshark.
- Identify DNS query and response messages.
- Analyze DNS header fields and resource records.
- Understand how domain names are translated into IP addresses.
- Interpret DNS flags and message formats.
Theory
Domain Name System (DNS)
The Domain Name System (DNS) is an Application Layer protocol used to translate human-readable domain names (such as www.mec.ac.in) into IP addresses (such as 103.xxx.xxx.xxx).
Without DNS, users would need to remember the IP address of every website.
DNS follows a client-server architecture.
When a user enters a website address in a browser:
- The browser checks its local DNS cache.
- If the address is not found, the operating system sends a DNS query to the configured DNS server.
- The DNS server searches for the requested domain name.
- The DNS server returns the corresponding IP address.
- The browser then contacts the web server using the returned IP address.
DNS Name Resolution Process
+-------------+ DNS Query +-------------+
| Client | -----------------------> | DNS Server |
+-------------+ +-------------+
^ |
| |
| DNS Response |
+----------------------------------------+
Client then connects to the Web Server using the resolved IP address.
DNS Message Format
A DNS message consists of the following sections:
+-------------------------------+
| Header |
+-------------------------------+
| Question Section |
+-------------------------------+
| Answer Section |
+-------------------------------+
| Authority Section |
+-------------------------------+
| Additional Information |
+-------------------------------+
DNS Header Format
The DNS header is 12 bytes long.
| Field | Size |
|---|---|
| Transaction ID | 16 bits |
| Flags | 16 bits |
| Questions | 16 bits |
| Answer RRs | 16 bits |
| Authority RRs | 16 bits |
| Additional RRs | 16 bits |
DNS Flags Field
The Flags field is 16 bits long.
0 15
+--+----+---+---+----+---+
|QR|Opcode|AA|TC|RD|RA|...|
+--+----+---+---+----+---+
Important bits
| Bit | Meaning |
|---|---|
| QR | Query (0) or Response (1) |
| AA | Authoritative Answer |
| TC | Message Truncated |
| RD | Recursion Desired |
| RA | Recursion Available |
Software Required
- Wireshark
- Web Browser (Chrome/Firefox/Edge)
- Internet Connection
- Windows/Linux Operating System
Preliminary Step: Clear the DNS Cache
To ensure that a fresh DNS lookup is generated, clear the DNS cache before starting the packet capture.
On Windows
Open Command Prompt and execute:
ipconfig /flushdns
Expected output:
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
On Linux (systemd)
Open a terminal and execute:
systemd-resolve --flush-caches
(For systems using resolvectl, use resolvectl flush-caches.)
Procedure
Step 1
Clear the DNS cache using the appropriate command for your operating system.
Step 2
Clear the browser cache to force a fresh DNS lookup.
Step 3
Open Wireshark.
Select the active network interface (Wi-Fi or Ethernet).
Click Start Capturing Packets.
Step 4
Open the web browser.
Visit your college website (for example, www.mec.ac.in )
Wait until the page loads completely.
Step 5
Return to Wireshark.
Stop packet capture.
Step 6
Apply the display filter:
dns
Only DNS packets will be displayed.
Understanding DNS Packets
You will typically observe two packets:
Packet 25
Standard Query
www.college.edu
Packet 26
Standard Query Response
www.college.edu
A 103.xxx.xxx.xxx
The first packet is the DNS Query.
The second packet is the DNS Response.
Packet Analysis
Click the DNS Query packet.
Expand
Domain Name System
You will observe
Transaction ID
Flags
Questions
Answer RRs
Authority RRs
Additional RRs
Answer the Following Questions
(a) Determine the Packet Number of the First DNS Query
Locate the first packet whose Info column shows:
Standard Query
Example
Packet No.
25
Answer
| Parameter | Value |
|---|---|
| Packet Number | 25 |
Explanation
The packet number is assigned by Wireshark only for display purposes and is not part of the DNS protocol.
(b) Is the Query Sent Using UDP or TCP?
Expand
User Datagram Protocol
Example
Protocol
UDP
Answer
DNS queries are normally sent using
UDP
Explanation
DNS uses UDP port 53 for most queries because it is faster and has lower overhead.
TCP is used for:
- Zone transfers
- Large DNS responses
- Responses requiring fragmentation or fallback
(c) Determine the Packet Number of the DNS Response
Locate
Standard Query Response
Example
Packet No.
26
Observe the transport protocol.
Example
UDP
Answer
| Parameter | Value |
|---|---|
| Packet Number | 26 |
| Transport Protocol | UDP |
(d) Source and Destination Port Numbers of the DNS Query
Expand
User Datagram Protocol
Example
Source Port
53128
Destination Port
53
Answer
| Parameter | Value |
|---|---|
| Source Port | 53128 (example) |
| Destination Port | 53 |
Explanation
- The source port is an ephemeral (dynamic) client port.
- The destination port is the well-known DNS server port (53).
(e) Source and Destination Port Numbers of the DNS Response
Example
Source Port
53
Destination Port
53128
Answer
| Parameter | Value |
|---|---|
| Source Port | 53 |
| Destination Port | 53128 |
The ports are reversed because the response is sent back to the client.
(f) IP Address to Which the DNS Query Is Sent
Expand
Internet Protocol Version 4
Example
Destination
8.8.8.8
or
192.168.1.1
depending on the configured DNS server.
Answer
The destination IP address is the configured DNS server.
Examples:
8.8.8.8
1.1.1.1
192.168.1.1
(g) Transaction ID (Message ID)
Expand
Transaction ID
Example
0x6a3c
Response packet
Transaction ID
0x6a3c
Both IDs should be identical.
Purpose
The Transaction ID uniquely matches a DNS response with the corresponding DNS query, allowing the client to associate replies with the correct outstanding request.
(h) Length of the Flags Field
The DNS Flags field is
16 bits
or
2 bytes
(i) Which Bit Indicates Query or Response?
The
QR
bit.
| Value | Meaning |
|---|---|
| 0 | Query |
| 1 | Response |
(j) Which Bits Are Used Only in the Response Message?
The response-specific bits include:
| Bit | Purpose |
|---|---|
| AA | Authoritative Answer – indicates the response comes from an authoritative DNS server. |
| RA | Recursion Available – indicates the server supports recursive queries. |
| RCODE | Response Code – indicates the outcome of the query (e.g., success or error). |
Common RCODE values:
| Code | Meaning |
|---|---|
| 0 | No Error |
| 1 | Format Error |
| 2 | Server Failure |
| 3 | Name Error (NXDOMAIN) |
| 5 | Refused |
(k) Number of Records in the Query Message
Expand
Questions
Answer RRs
Authority RRs
Additional RRs
Example
Questions
1
Answer RRs
0
Authority RRs
0
Additional RRs
0
Answer
| Record Type | Value |
|---|---|
| Question Records | 1 |
| Answer Records | 0 |
| Authority Records | 0 |
| Additional Records | 0 |
(l) Number of Records in the Response Message
Example
Questions
1
Answer RRs
1
Authority RRs
0
Additional RRs
1
The exact numbers vary depending on the DNS server and the query type.
Typical answer:
| Record Type | Typical Value |
|---|---|
| Question Records | 1 |
| Answer Records | 1 or more |
| Authority Records | 0 or more |
| Additional Records | 0 or more |
Observation Table
| Parameter | Observed Value |
|---|---|
| Packet Number (Query) | ________________ |
| Packet Number (Response) | ________________ |
| Transport Protocol | ________________ |
| Source Port (Query) | ________________ |
| Destination Port (Query) | ________________ |
| Source Port (Response) | ________________ |
| Destination Port (Response) | ________________ |
| DNS Server IP Address | ________________ |
| Transaction ID | ________________ |
| Flags Field Length | ________________ |
| QR Bit Value | ________________ |
| Question Records | ________________ |
| Answer Records | ________________ |
| Authority Records | ________________ |
| Additional Records | ________________ |
Result
The DNS query and response packets were successfully captured and analyzed using Wireshark. The experiment demonstrated the DNS name resolution process, including the identification of query and response messages, transport protocol, IP addresses, port numbers, transaction ID, flags, and resource records.Gained practical experience in understanding how domain names are resolved into IP addresses before communication with a web server begins.
Precautions
- Flush the DNS cache before starting the capture to ensure a new DNS query is generated.
- Clear the browser cache to avoid cached DNS lookups.
- Start Wireshark before opening the website.
-
Apply the
dnsdisplay filter only after the capture is complete. - Use a website that has not been recently visited to increase the likelihood of observing a DNS query.
- Modern systems may issue both IPv4 (A) and IPv6 (AAAA) DNS queries; examine both if present.
Additional Exercises
- Capture DNS traffic while visiting three different websites and compare the number of answer records returned.
- Observe both A (IPv4) and AAAA (IPv6) queries and compare their responses.
- Identify the Time-To-Live (TTL) values in the DNS response and explain their significance.
- Analyze a DNS query that returns an NXDOMAIN response and identify the corresponding RCODE.
- Compare DNS traffic generated when using a public DNS server (e.g., 8.8.8.8) versus a local ISP DNS server.
- Capture traffic while repeatedly accessing the same website with and without flushing the DNS cache, and compare the observed DNS packets to understand the effect of caching.
Comments
Post a Comment