DNS协议分析

我一直渴望了解我所知道的事物的原理: 计算机网络，操作系统等. 今天，我研究了DNS协议.

DNS协议是一个应用层协议，通常基于UDP协议，但是我使用TCP协议传输读取了Golangnet软件包中的相关源代码. 端口是53. 这次我编写了实现DNS客户端的代码. 我想我不会在短时间内忘记此端口号.

了解DNS协议，我还没有从书中读过它. 在书中，我基本上记得DNS是递归查询. 如果在查询服务器上找不到对应的记录，则对上级服务器进行递归查询. 无论如何，我从不了解美国的根域名服务器.

昨天我在互联网上找到了一篇文章[2]. 上面提到，最好使用WireShark学习协议. 在Linux下，它是通过tcpdump和WireShark的组合来获取数据包的. 具体方法可以参考我以前的文章. 模拟的DNS请求在Linux下为主机，在Windows下为nslookup.

1	0.000000	10.0.1.23	10.0.1.1	DNS	73	Standard query 0x11ac  A www.cyeam.com
2	0.061714	10.0.1.1	10.0.1.23	DNS	123	Standard query response 0x11ac  CNAME vm68h.x.incapdns.net A 149.126.77.152

我的计算机IP为10.0.1.23，路由器IP为10.0.1.1，查询网站的DNS记录.

捕获的请求的内容如下:

Domain Name System (query)
    [Response In: 2]
    Transaction ID: 0x11ac
    Flags: 0x0100 Standard query
	0... .... .... .... = Response: Message is a query
	.000 0... .... .... = Opcode: Standard query (0)
	.... ..0. .... .... = Truncated: Message is not truncated
	.... ...1 .... .... = Recursion desired: Do query recursively
	.... .... .0.. .... = Z: reserved (0)
	.... .... ...0 .... = Non-authenticated data: Unacceptable
    Questions: 1
    Answer RRs: 0
    Authority RRs: 0
    Additional RRs: 0
    Queries
	www.cyeam.com: type A, class IN
	    Name: www.cyeam.com
	    Type: A (Host address)
	    Class: IN (0x0001)

DNS协议标头为12个字节，总共两个项目，每个项目为两个字节.

在协议标头之后，它是消息正文. 在请求中，消息正文是查询的内容，在响应中，内容是查询. 邮件正文由三个方面组成: 域名dns协议详解，类别，分类:

The

标头是12个字节，消息正文使用15 + 2 + 2 = 19个字节，一个是31个字节. 下表以十六进制计数. 连续有16行，总共有15行. 您还可以查看协议标头和消息正文的内容.

0000   11 ac 01 00 00 01 00 00 00 00 00 00 03 77 77 77
0010   05 63 79 65 61 6d 03 63 6f 6d 00 00 01 00 01

响应头如下:

Domain Name System (response)
    [Request In: 1]
    [Time: 0.061714000 seconds]
    Transaction ID: 0x11ac
    Flags: 0x8180 Standard query response, No error
	1... .... .... .... = Response: Message is a response
	.000 0... .... .... = Opcode: Standard query (0)
	.... .0.. .... .... = Authoritative: Server is not an authority for domain
	.... ..0. .... .... = Truncated: Message is not truncated
	.... ...1 .... .... = Recursion desired: Do query recursively
	.... .... 1... .... = Recursion available: Server can do recursive queries
	.... .... .0.. .... = Z: reserved (0)
	.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
	.... .... ...0 .... = Non-authenticated data: Unacceptable
	.... .... .... 0000 = Reply code: No error (0)
    Questions: 1
    Answer RRs: 2
    Authority RRs: 0
    Additional RRs: 0
    Queries
	www.cyeam.com: type A, class IN
	    Name: www.cyeam.com
	    Type: A (Host address)
	    Class: IN (0x0001)
    Answers
	www.cyeam.com: type CNAME, class IN, cname vm68h.x.incapdns.net
	    Name: www.cyeam.com
	    Type: CNAME (Canonical name for an alias)
	    Class: IN (0x0001)
	    Time to live: 10 seconds
	    Data length: 22
	    Primaryname: vm68h.x.incapdns.net
	vm68h.x.incapdns.net: type A, class IN, addr 149.126.77.152
	    Name: vm68h.x.incapdns.net
	    Type: A (Host address)
	    Class: IN (0x0001)
	    Time to live: 3 minutes, 47 seconds
	    Data length: 4
	    Addr: 149.126.77.152 (149.126.77.152)

协议标头的含义与请求相同. 应该注意的是，答案为2，因为找到了两个记录. 消息主体还包含请求的查询的内容dns协议详解，其含义与请求中的相同. 更重要的是响应的内容.

查询结果由5部分组成:

可以从此处访问上面捕获的数据包. 本来我想写Golang语言实现的，为时已晚，我明天再写.

“计算机网络（第五版）”谢锡仁

本文来自电脑杂谈，转载请注明本文网址：
https://www.pc-fly.com/a/ruanjian/article-226309-1.html