Reviewing the DNS packet

DNS is a client-server model for resolving a hostname to an IP address. To see a DNS packet in its entirety, go to DNS Question & Answer.pcapng and expand the Domain Name System (response) caret in Frame 2, which is shown as follows:

Figure 13.5 – Expanded DNS packet

As you can see, there are several parts to the DNS packet, as follows:

• The first section (1) is the DNS header.
• The second section (2) summarizes the contents.
• The third section (3) is the query section.
• The fourth section (4) are Wireshark-specific references.

In this section, we'll review the field values in a DNS header, review the structure of a DNS packet, and then compare the DNS question and answer section.

Let's start with examining the DNS header elements.

Examining the header

The header structure for either the client or the server is the same. What will be different are the field values for each header...