DNS 查询结构

发布于 2024-08-12 08:36:21 字数 528 浏览 1 评论 0原文

当我向 DNS 发送 DNS 查询时,它返回设置了格式位的标头。 表明格式有问题,但我看不出它是什么。我可能误解了 RFC,或者误读了它,但现在我似乎无法解决它。

我发送的 DNS 结构在十六进制中看起来像这样。

Header

00 01   - ID = 1
01 00   - RD = 1
00 01   - QD = 1
00 00   - AN
00 00   - NS
00 00   - NR


   Question  for www.google.com

   03 77   - 3 w
   77 77   - w w
   06 67   - 6 g
   6f 6f   - o o
   67 6c   - g l
   65 03   - e 3
   63 6f   - c o
   6d 00   - m 0
   00 01   - QTYPE
   00 01   - QCLASS

然后,我翻转任何两个字节字段的字节,以转换为网络格式的大端字节序。所以标题的每一行,然后是 QTYPE 和 QCLASS ...

When I am sending a DNS query to the DNS it returns the header with the format bit set.
Indicating there is a problem with the format, but I am failing to see what it is. Its possible I have misinterpreted the RFC, or misread it but right now I cant seem to work it out.

The DNS structure I am sending looks like this in hex.

Header

00 01   - ID = 1
01 00   - RD = 1
00 01   - QD = 1
00 00   - AN
00 00   - NS
00 00   - NR


   Question  for www.google.com

   03 77   - 3 w
   77 77   - w w
   06 67   - 6 g
   6f 6f   - o o
   67 6c   - g l
   65 03   - e 3
   63 6f   - c o
   6d 00   - m 0
   00 01   - QTYPE
   00 01   - QCLASS

I then flip the bytes for any field that is two bytes, to convert to big endian for the network format. So each row of the header, and then QTYPE and QCLASS ...

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(3

长途伴 2024-08-19 08:36:21

该查询数据包的逐字节十六进制转储应如下所示(经过测试并正常工作!):

00000000  00 01 01 00 00 01 00 00  00 00 00 00 03 77 77 77  |.............www|
00000010  06 67 6f 6f 67 6c 65 03  63 6f 6d 00 00 01 00 01  |.google.com.....|

我认为您的问题是数据包的第三个和第四个字节(flagsrcode)是两个单字节字段,而不是一个 2 字节字段 - 看起来您可能将其视为 16 位整数并交换字节?

Here's what a byte-by-byte hexdump of that query packet should look like (tested and working!):

00000000  00 01 01 00 00 01 00 00  00 00 00 00 03 77 77 77  |.............www|
00000010  06 67 6f 6f 67 6c 65 03  63 6f 6d 00 00 01 00 01  |.google.com.....|

I think your problem is that the third and fourth bytes of the packet (flags and rcode) are two single-byte fields, not one 2-byte field - it looks like you might be treating it as a 16 bit integer and swapping the bytes?

遇到 2024-08-19 08:36:21

要获取这些,您可以使用 netcat 和 dig。

# nc –uip 53 > dnsreqdump
# dig www.example.com @localhost
# nc –u 8.8.8.8 53 <dnsreqdump >dnsrespdump

现在您可以在 hexedit 或您最喜欢的十六进制编辑器中检查它们。

To get these you can use netcat and dig.

# nc –uip 53 > dnsreqdump
# dig www.example.com @localhost
# nc –u 8.8.8.8 53 <dnsreqdump >dnsrespdump

Now you can inspect them in hexedit or your favorite hex editor.

热情消退 2024-08-19 08:36:21

我倾向于认为您的问题取决于您实际上如何“翻转位以转换为网络格式”。

典型的 C 库实现提供 htonl() 函数系列进行从主机到网络顺序的转换,反之亦然。

当然,在没有看到代码的情况下,我无法确定这就是问题所在。

I tend to think that your problem depends on how are you actually "flipping the bits to convert to network format".

Typical C library implementations provide the htonl() function family to do the conversion from host into network order and viceversa.

Of course, without seeing the code, I cannot be sure that this is the problem.

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文