View DNS data datagram via wireshark

[selfboot]

We use dig google.com to find the IP address of google.com, and use wireshark to capture the DNS datagram.

Request

Following is the request data info:

Response

Following is the response data info, header section is somehow different with the request datagram, which is as follows:

There is answer section in response, as follows:

About domain name compression, you can refer #42. Note that the offset in compression(here is 0c in c00c) is started at the very first field in the DNS portion of the packet, which is the transaction ID, and count down 12 bytes.

Ref
RFC 1035
DNS Primer Note
#42

[selfboot]

Wireshark pacpng file is as follows:

DNS.pcapng.zip