The first bit identifies the query (value = 0) or the response (value = 1).A flag section (only the first two parameters are discussed here, the others will be discussed in another article about DNS).A transaction ID that links a query with its related response.The structure of both the DNS query and the DNS response is identical and is composed of: The corresponding DNS response looks like this: Wireshark trace: DNS query and reply structure Let’s have a look at one DNS query and corresponding response in Wireshark. Look up other names elements such as MX records (mail exchange)Ī DNS query and a DNS reply share the same basic structure.Transfer information between DNS servers.Convert IP addresses to hostnames (this is called inverse or pointer query).TCP can also be used for response data size exceeding 512 bytes or for specific tasks such as zone transfers. DNS uses UDP port 53 to connect to the server.

This request is followed by a single UDP reply from the DNS server.

The client queries an information (for example the IP address corresponding to in a single UDP request. Instead, only the network configuration of the clients’ workstations needs to be modified to make it valid for all applications that are used.ĭNS is a query/response protocol. If the network administrator decides to change the DNS server’s IP address for any reason, the applications that rely on it do not have to be modified. It is for example much more easier to remember a FQDN – Fully Qualified Domain Name) than 172.217.17.36 !ĭNS provides not only clarity to users, it also provides a much greater level of flexibility. This is the first in a series of articles (see article 2 and article 3) covering some important aspects to know about the DNS protocol, including the DNS query and DNS response, when troubleshooting application performance issues.įirst of all, let’s have a look at the DNS protocol itself. DNS stands for Domain Name System and comes from the fact that humans prefer names to numbers (but computers don’t).

DNS Query Types and Application Troubleshooting: An Introduction

Wireshark dns analysis