Linux Network Programming: DNS message format

The message consists of a 12-byte header and four variable-length fields.IdentifierThe field is set by the client program and the server returns the result. 16-bitFlagThe fields are as follows:

QR: 0 indicates the query message, and 1 indicates the Response Message.
Opcode: Usually the value is 0 (standard query), other values are 1 (reverse query) and 2 (server status requests ).
AA: authoritative answer ).
TC: truncated)
RD: Indicates expected Recursion
RA: indicates that recursion is available.
Then the 3bit value must be 0.
Rcode: return code, usually 0 (no error) and 3 (name error)
The last four 16-bit fields indicate the number of entries in the last four variable-length fields.

Problem section:
Message format:

The query name is the name to be searched. It consists of one or more identifiers. The length of each marker ending with 0. The Count bytes must be 0 ~ Between 63. This field does not need to be filled in bytes. Example: gemini.tuc.noao.edu

Each question has A query type. Generally, the query type is A (obtained by the name of the IP address) or PTR (obtained the domain name corresponding to the IP address)
Resource record:
Message format:
The last three DNS fields are the answer fields. The authorization fields and additional information fields are in the same format as the resource record RR (ResourceRecord.

The domain name is the name corresponding to the resource data in the record. It is in the same format as the query name segment.
Type description RR type code. Class is usually 1, which refers to I n t e r n e t data.
The survival time field is the number of seconds that the customer program retains the resource record.
The length of resource data indicates the number of resource data. The data format depends on the value of the type field. Resource Data of type 1 (A record) is A 4-byte I P address.

Data Packet DNS query: (DNS query)
0000 00 19 56 6e19 bf 00 17 a4 1ab2 e0 08 00 45 00... Vn ...... E.
0010 00 3b ed c600 00 80 11 e3 c3 ac 15 0f 04 ac15 .;..............
0020 01 f9 04 a9 00 35 00 27 2f bd 3e 3a01 00 00 01 ...... 5 .. '/> :....
0030 00 00 0000 00 00 03 77 77 06 67 6f6f 67 6c ...... w ww. googl
0040 65 02 636e 00 00 01 00 01 e.cn .....
Note:
The first three sections are Ethernet headers, ip headers, and UDP headers.
The DNS data packet starts from the end of Row 3.
3e 3aIs the Identifier Field
01 00Indicates the flag field. If TC is set for this field, the message can be truncated.
00 01The number of Query Packets is 1.
00 00 00 00 00 00Indicates the answer. The authorization and additional information are both 0.
03 77 77 77 0667 6f 6f 67 6c65 02 63 6e 00Indicates that the query name is
Www.google.com
00 01Type, 1 indicates A query
00 01Is a class, and 1 indicates Internet data.

Data Packet DNS response (DNSresponse)
0000 00 17 a4 1a b2 e0 00 19 56 6e 19 bf 08 00 45 00 ...... Vn ...... E.
0010 00 78 48 af00 00 7d 11 8b 9e ac 15 01 f9 ac 15. xH ...}.........
0020 0f 04 00 35 04 a9 00 64 75 db 3e 3a 81 80 00 01... 5... d u...> :....
0030 00 03 0000 00 00 03 77 77 06 67 6f6f 67 6c ...... w ww. googl
0040 65 02 636e 00 00 01 00 01 c00c 00 05 00 01 00e.cn ............
0050 00 05 4200 11 02 63 6e 01 6c06 67 6f 6f 67 6c.. B ..cn. l. googl
0060 65 03 63 6f 6d 00 c0 2b 00 01 00 00 00 00 5f e.com... + ......._
0070 00 04 cbd0 21 65 c0 2b 0001 00 01 00 00 00 5f ....! E. + ......._
0080 00 04 cbd0 21 64 ....! D
Note:
The first three sections are Ethernet headers, ip headers, and UDP headers.
3e 3aIs the Identifier Field
81 80Set QR = 1, RD = 1, RA = 1
00 01 questions 1. Answers 3, and the other two are 0.
03 77 77 77 0667 6f 6f 67 6c65 02 63 6e 00Indicates that the query name is
Www.google.com
00 01Type, 1 indicates A query
00 01Is a class, and 1 indicates Internet data.
Next is the response message,
C0 0c is the domain name pointer
00 05 indicates CNAME (canonical name)
00 01 class, indicating Internet Data
00 00 05 42 survival time
00 11 Data Length
02 63 6e 01 6c 06 67 6f 6f67 6c 65 03 63 6f 6d 00 data cn.l.google.cn
The next two paragraphs are the other two answers.
The last data is the IP address.