☰

DNS 请求是什么样的？

tag-icon • tag-icon domain-name-system tcpip
DNS 请求是什么样的？

我已经看到了 HTTP 请求的文本表示，但 DNS 请求是什么样的？您尝试定位的 URL 的位置在数据中的什么位置？此外，响应的格式如何？

答案1

这是来自 Wireshark 的 DNS 查询的原始转储。

DNS部分以24 1a开头：

0000  00 00 00 00 00 00 00 00  00 00 00 00 08 00 45 00   ........ ......E.
0010  00 3c 51 e3 40 00 40 11  ea cb 7f 00 00 01 7f 00   .<Q.@.@. ........
0020  00 01 ec ed 00 35 00 28  fe 3b 24 1a 01 00 00 01   .....5.( .;$.....
0030  00 00 00 00 00 00 03 77  77 77 06 67 6f 6f 67 6c   .......w ww.googl
0040  65 03 63 6f 6d 00 00 01  00 01                     e.com... ..

具体细节如下：

Domain Name System (query)
    [Response In: 1852]
    Transaction ID: 0x241a
    Flags: 0x0100 (Standard query)
        0... .... .... .... = Response: Message is a query
        .000 0... .... .... = Opcode: Standard query (0)
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...1 .... .... = Recursion desired: Do query recursively
        .... .... .0.. .... = Z: reserved (0)
        .... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable
    Questions: 1
    Answer RRs: 0
    Authority RRs: 0
    Additional RRs: 0
    Queries
        www.google.com: type A, class IN
            Name: www.google.com
            Type: A (Host address)
            Class: IN (0x0001)

响应同样从 24 1a 开始：

0000  00 00 00 00 00 00 00 00  00 00 00 00 08 00 45 00   ........ ......E.
0010  00 7a 00 00 40 00 40 11  3c 71 7f 00 00 01 7f 00   .z..@.@. <q......
0020  00 01 00 35 ec ed 00 66  fe 79 24 1a 81 80 00 01   ...5...f .y$.....
0030  00 03 00 00 00 00 03 77  77 77 06 67 6f 6f 67 6c   .......w ww.googl
0040  65 03 63 6f 6d 00 00 01  00 01 c0 0c 00 05 00 01   e.com... ........
0050  00 05 28 39 00 12 03 77  77 77 01 6c 06 67 6f 6f   ..(9...w ww.l.goo
0060  67 6c 65 03 63 6f 6d 00  c0 2c 00 01 00 01 00 00   gle.com. .,......
0070  00 e3 00 04 42 f9 59 63  c0 2c 00 01 00 01 00 00   ....B.Yc .,......
0080  00 e3 00 04 42 f9 59 68                            ....B.Yh

分解：

Domain Name System (response)
    [Request In: 1851]
    [Time: 0.000125000 seconds]
    Transaction ID: 0x241a
    Flags: 0x8180 (Standard query response, No error)
        1... .... .... .... = Response: Message is a response
        .000 0... .... .... = Opcode: Standard query (0)
        .... .0.. .... .... = Authoritative: Server is not an authority for domain
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...1 .... .... = Recursion desired: Do query recursively
        .... .... 1... .... = Recursion available: Server can do recursive queries
        .... .... .0.. .... = Z: reserved (0)
        .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
        .... .... .... 0000 = Reply code: No error (0)
    Questions: 1
    Answer RRs: 3
    Authority RRs: 0
    Additional RRs: 0
    Queries
        www.google.com: type A, class IN
            Name: www.google.com
            Type: A (Host address)
            Class: IN (0x0001)
    Answers
        www.google.com: type CNAME, class IN, cname www.l.google.com
            Name: www.google.com
            Type: CNAME (Canonical name for an alias)
            Class: IN (0x0001)
            Time to live: 3 days, 21 hours, 52 minutes, 57 seconds
            Data length: 18
            Primary name: www.l.google.com
        www.l.google.com: type A, class IN, addr 66.249.89.99
            Name: www.l.google.com
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 3 minutes, 47 seconds
            Data length: 4
            Addr: 66.249.89.99
        www.l.google.com: type A, class IN, addr 66.249.89.104
            Name: www.l.google.com
            Type: A (Host address)
            Class: IN (0x0001)
            Time to live: 3 minutes, 47 seconds
            Data length: 4
            Addr: 66.249.89.104

编辑：

请注意，如果您的真正问题是“如何编写 DNS 服务器？”，那么有两个合适的答案：

编辑(2)：

该请求是host在 Linux 机器上使用以下方式发送的：

host www.google.com

如果你使用的是 Windows，你可以使用nslookup

nslookup www.google.com

答案2

DNS 请求数据布局描述如下RFC 1035。我觉得在这里复制文字有点没意义……

答案3

最好使用协议分析器查看 DNS 查询和响应 -Wireshark是一款出色的跨平台工具，可以捕获请求和响应并将其分解为各个部分。在Firewall.cx 这里。

DNS 请求包含指定名称（或可能是任意的文本字段）和记录类型的问题 - 响应的内容将根据类型而有所不同。大多数请求都是简单的直接查找服务器名称以查找响应中的 IP 地址（类型 A），但有些请求会查找有关名称服务器本身的更多信息（类型 NS）、邮件记录（类型 MX）和其他服务（将返回名称、端口、权重和优先级的类型 SRV）。DNS 响应包含这些问题的答案，如果请求需要，可能不止一个，而且并不总是 IP 地址。

另一个澄清是 - DNS 不能解析 URL - 在大多数涉及 URL 的场景中，DNS 仅用于使客户端系统能够找到 URL 的服务器部分的 IP 地址，其他一切都由其他协议处理。

答案4

如果你能进入 Linux 机器，你可以运行挖命令执行 DNS 查找。此实用程序执行查找并返回名称服务器的响应。例如：

; <<>> DiG 9.6.1-P2 <<>> serverfault.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32383
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;serverfault.com.               IN      A

;; ANSWER SECTION:
serverfault.com.        55961   IN      A       69.59.196.211

;; Query time: 21 msec
;; SERVER: 68.87.64.150#53(68.87.64.150)
;; WHEN: Sun Aug 22 09:21:35 2010
;; MSG SIZE  rcvd: 49

以“HEADER”部分开头的所有内容都是从名称服务器返回的内容。我假设这就是您所指的文本格式，因为这不是实际数据包的格式，但它是返回的文本。

相关内容