实验报告DNS协议分析.doc

DNS协议分析实验报告姓名：学号：200841903327班级：08级计算机3班实验目的：熟悉nslookup命令的使用深入理解DNS工作原理实验原理DNS工作原理实验内容: 分析下面三个命令产生的DNS数据报C:nslookup Server: Address: 8Non-authoritative answer:Name: Address: 0C:nslookup -type=ns Server: Address: 8 primary name server = responsible mail addr = serial = 2001082925 refresh = 3600 (1 hour) retry = 900 (15 mins) expire = 1209600 (14 days) default TTL = 43200 (12 hours)C:nslookup Server: Address: 38Name: Address: 0实验步骤：1 设置首选dns服务器地址：122 清空本地dns缓存信息cmdC:Documents and Settingsadministrator ipconfig /flushdns3 启动wireshark，设置抓包状态4 抓取下面3个命令产生的数据报(1)nslookup (2)nslookup -type=ns (3)nslookup 说明：正常情况通常产生14个数据包，其中第1个命令为第1-4个数据包，第2个命令为5-8，第3个命令为9-14实验结果分析：要求：对域名 的IP地址解析请求和应答报文应逐字段分析，其它报文指出其主要功能即可。本地IP：本地MAC： No. Time Source Destination Protocol Info 1 0.000000 2 12 DNS Standard query PTR 02.0000 00 d0 f8 c6 05 26 00 10 5c cb 14 81 08 00 45 00 .&.E.0010 00 49 03 51 00 00 80 11 52 55 ac 10 0e 16 ca 67 .I.Q.RU.g0020 60 70 04 93 00 35 00 35 93 a5 00 01 01 00 00 01 p.5.5.0030 00 00 00 00 00 00 03 31 31 32 02 39 36 03 31 30 .112.96.100040 33 03 32 30 32 07 69 6e 2d 61 64 64 72 04 61 72 3.202.in-addr.ar0050 70 61 00 00 0c 00 01 pa.功能：请求报文，02的反向域名解析是由哪台DNS服务器负责的.No. Time Source Destination Protocol Info 2 0.008353 12 2 DNS Standard query response PTR 0000 00 10 5c cb 14 81 00 d0 f8 c6 05 26 08 00 45 00 .&.E.0010 00 64 59 7b 40 00 f5 11 47 0f ca 67 60 70 ac 10 .dY.G.gp.0020 0e 16 00 35 04 93 00 50 6f d8 00 01 81 80 00 01 .5.Po.0030 00 01 00 00 00 00 03 31 31 32 02 39 36 03 31 30 .112.96.100040 33 03 32 30 32 07 69 6e 2d 61 64 64 72 04 61 72 3.202.in-addr.ar0050 70 61 00 00 0c 00 01 c0 0c 00 0c 00 01 00 00 79 pa.y0060 54 00 0f 04 64 6e 73 32 02 63 73 02 68 6e 02 63 T.dns2.cs.hn.c0070 6e 00 n.功能：应答报文，负责02的反向域名解析。No. Time Source Destination Protocol Info 3 0.014369 2 12 DNS Standard query A 0000 00 d0 f8 c6 05 26 00 10 5c cb 14 81 08 00 45 00 .&.E.0010 00 3b 03 52 00 00 80 11 52 62 ac 10 0e 16 ca 67 .;.R.Rb.g0020 60 70 04 94 00 35 00 27 52 b9 00 02 01 00 00 01 p.5.R.0030 00 00 00 00 00 00 03 77 77 77 05 68 75 6e 61 75 .www.hunau0040 03 6e 65 74 00 00 01 00 01 .net.功能：客户端向DNS请求解析的IP地址。00 02表示标识，01 00 为标志字段，该字段设置了QR为0为查询报文，RD为0表示期望递归没有一个权威回答，TC为1表示该报文是可截断的，00 01 查询报文数量为1，00 00 00 00 00 00 表示回答，授权和额外信息都为0，03 77 77 77 05 68 75 6e 61 75 03 6e 65 74 00表示查询名字为。 00 01表示类型，1为A查询，00 01表示类，1为Internet数据。No. Time Source Destination Protocol Info 4 0.020048 12 2 DNS Standard query response A 00000 00 10 5c cb 14 81 00 d0 f8 c6 05 26 08 00 45 00 .&.E.0010 00 4b 80 27 40 00 f5 11 20 7c ca 67 60 70 ac 10 .K. |.gp.0020 0e 16 00 35 04 94 00 37 02 6f 00 02 81 80 00 01 .5.7.o.0030 00 01 00 00 00 00 03 77 77 77 05 68 75 6e 61 75 .www.hunau0040 03 6e 65 74 00 00 01 00 01 c0 0c 00 01 00 01 00 .net.0050 00 73 d9 00 04 3d bb 37 28 .s.=.7(功能：DNS回答客户端关于的IP地址为0。00 02表示标识，81 80为标志字段,其中设置了QR = 1表示应答报文，RD = 1期望递归有一个权威回答，RA = 1表示服务器支持递归查询，00 01表示问题数为1，00 01表示回答数为1，授权和额外信息资源数都为0. 03 77 77 77 05 68 75 6e 61 75 03 6e 65 74 00表示查询名字为。00 01表示类型，1为A查询，00 01表示类，1为Internet数据。c0 0c表示为域名指针，00 01表示类型，00 01表示类，1为Internet数据，00 00 74 74为生存时间，00 04表示数据长度，3d bb 37 28为的IP地址表示为0No. Time Source Destination Protocol Info 5 4.677584 2 12 DNS Standard query PTR 02.0000 00 d0 f8 c6 05 26 00 10 5c cb 14 81 08 00 45 00 .&.E.0010 00 49 03 53 00 00 80 11 52 53 ac 10 0e 16 ca 67 .I.S.RS.g0020 60 70 04 95 00 35 00 35 93 a3 00 01 01 00 00 01 p.5.5.0030 00 00 00 00 00 00 03 31 31 32 02 39 36 03 31 30 .112.96.100040 33 03 32 30 32 07 69 6e 2d 61 64 64 72 04 61 72 3.202.in-addr.ar0050 70 61 00 00 0c 00 01 pa.功能：请求报文，02的反向域名解析是由哪台DNS服务器负责的.No. Time Source Destination Protocol Info 6 4.692879 12 2 DNS Standard query response PTR 0000 00 10 5c cb 14 81 00 d0 f8 c6 05 26 08 00 45 00 .&.E.0010 00 64 f2 81 40 00 f5 11 ae 08 ca 67 60 70 ac 10 .d.gp.0020 0e 16 00 35 04 95 00 50 af d5 00 01 81 80 00 01 .5.P.0030 00 01 00 00 00 00 03 31 31 32 02 39 36 03 31 30 .112.96.100040 33 03 32 30 32 07 69 6e 2d 61 64 64 72 04 61 72 3.202.in-addr.ar0050 70 61 00 00 0c 00 01 c0 0c 00 0c 00 01 00 00 7a pa.z0060 14 00 0f 04 64 6e 73 32 02 63 73 02 68 6e 02 63 .dns2.cs.hn.c0070 6e 00 n.功能：应答报文，负责02的反向域名解析No. Time Source Destination Protocol Info 7 4.699007 2 12 DNS Standard query NS 0000 00 d0 f8 c6 05 26 00 10 5c cb 14 81 08 00 45 00 .&.E.0010 00 3b 03 54 00 00 80 11 52 60 ac 10 0e 16 ca 67 .;.T.R.g0020 60 70 04 96 00 35 00 27 51 b7 00 02 01 00 00 01 p.5.Q.0030 00 00 00 00 00 00 03 77 77 77 05 68 75 6e 61 75 .www.hunau0040 03 6e 65 74 00 00 02 00 01 .net.功能：客户端向DNS正向解析的域名是哪个服务器负责的。No. Time Source Destination Protocol Info 8 4.712852 12 2 DNS Standard query response0000 00 10 5c cb 14 81 00 d0 f8 c6 05 26 08 00 45 00 .&.E.0010 00 7b f2 82 40 00 f5 11 ad f0 ca 67 60 70 ac 10 .gp.0020 0e 16 00 35 04 96 00 67 e4 c8 00 02 81 80 00 01 .5.g.0030 00 00 00 01 00 00 03 77 77 77 05 68 75 6e 61 75 .www.hunau0040 03 6e 65 74 00 00 02 00 01 c0 10 00 06 00 01 00 .net.0050 00 1c cc 00 34 02 6e 73 07 74 69 6d 65 73 6f 6e .4.ns.timeson0060 03 63 6f 6d 02 63 6e 00 0a 68 6f 73 74 6d 61 73 ..hostmas0070 74 65 72 c0 2b 77 46 1a 2d 00 00 0e 10 00 00 03 ter.+wF.-.0080 84 00 12 75 00 00 00 a8 c0 .u.功能：DNS对客户端的应答。No. Time Source Destination Protocol Info 9 9.599577 2 12 DNS Standard query A 0000 00 d0 f8 c6 05 26 00 10 5c cb 14 81 08 00 45 00 .&.E.0010 00 3f 03 55 00 00 80 11 52 5b ac 10 0e 16 ca 67 .?.U.R.g0020 60 70 04 97 00 35 00 2b e8 1c be 18 01 00 00 01 p.5.+.0030 00 00 00 00 00 00 02 6e 73 07 74 69 6d 65 73 6f .ns.timeso0040 6e 03 63 6f 6d 02 63 6e 00 00 01 00 01 .功能：请求报文，域名解析所对应的IP地址是多少。No. Time Source Destination Protocol Info 10 9.613102 12 2 DNS Standard query response A 380000 00 10 5c cb 14 81 00 d0 f8 c6 05 26 08 00 45 00 .&.E.0010 00 4f 59 c4 40 00 f5 11 46 db ca 67 60 70 ac 10 .OY.F.gp.0020 0e 16 00 35 04 97 00 3b e5 7c be 18 81 80 00 01 .5.;.|.0030 00 01 00 00 00 00 02 6e 73 07 74 69 6d 65 73 6f .ns.timeso0040 6e 03 63 6f 6d 02 63 6e 00 00 01 00 01 c0 0c 00 .0050 01 00 01 00 00 33 7d 00 04 ca 67 40 8a .3.g.功能：DNS对客户端的应答所对应的地址是38No. Time Source Destination Protocol Info 11 9.617611 2 38 DNS Standard query PTR 02.0000 00 d0 f8 c6 05 26 00 10 5c cb 14 81 08 00 45 00 .&.E.0010 00 49 03 56 00 00 80 11 72 36 ac 10 0e 16 ca 67 .I.V.r6.g0020 40 8a 04 98 00 35 00 35 b3 83 00 01 01 00 00 01 .5.5.0030 00 00 00 00 00 00 03 31 33 38 02 36 34 03 31 30 .138.64.100040 33 03 32 30 32 07 69 6e 2d 61 64 64 72 04 61 72 3.202.in-addr.ar0050 70 61 00 00 0c 00 01 pa.功能：请求报文， 地址02是哪个负责的正向解析的。No. Time Source Destination Protocol I