search

selfboot / AnnotatedShadowSocks

Annotated shadowsocks(python version)
Other
3 stars 1 forks source link

View DNS data datagram via wireshark #39

Open selfboot opened 7 years ago

selfboot commented 7 years ago

We use dig google.com to find the IP address of google.com, and use wireshark to capture the DNS datagram.

Request

Following is the request data info:

image

Response

Following is the response data info, header section is somehow different with the request datagram, which is as follows:

image

There is answer section in response, as follows:

image

About domain name compression, you can refer #42. Note that the offset in compression(here is 0c in c00c) is started at the very first field in the DNS portion of the packet, which is the transaction ID, and count down 12 bytes.

Ref RFC 1035
DNS Primer Note
https://github.com/xuelangZF/AnnotatedShadowSocks/issues/42

selfboot commented 6 years ago

Wireshark pacpng file is as follows:

DNS.pcapng.zip