DNS
1.1.1.1이나 8.8.8.8 대신에 직접 Authoritative DNS Server를 찾아서 A 레코드 가져오기
PS C:\Users\ygone> nslookup anacnu.kr
서버: one.one.one.one
Address: 1.1.1.1
권한 없는 응답:
이름: anacnu.kr
Address: 168.188.124.140
anacnu.kr을 직접 1.1.1.1에 Resolve 요청했을 때는 IP를 얻을 수 있습니다.
PS C:\Users\ygone> nslookup
기본 서버: one.one.one.one
Address: 1.1.1.1
> set type=NS
> anacnu.kr
서버: one.one.one.one
Address: 1.1.1.1
권한 없는 응답:
anacnu.kr nameserver = bradley.ns.cloudflare.com
anacnu.kr nameserver = haley.ns.cloudflare.com
> server bradley.ns.cloudflare.com
기본 서버: bradley.ns.cloudflare.com
Addresses: 2606:4700:58::a29f:2c23
2803:f800:50::6ca2:c323
2a06:98c1:50::ac40:2323
108.162.195.35
162.159.44.35
172.64.35.35
> anacnu.kr
서버: bradley.ns.cloudflare.com
Addresses: 2606:4700:58::a29f:2c23
2803:f800:50::6ca2:c323
2a06:98c1:50::ac40:2323
108.162.195.35
162.159.44.35
172.64.35.35
*** bradley.ns.cloudflare.com이(가) anacnu.kr을(를) 찾을 수 없습니다. No response from server
그런데 직접 Authoritative한 bradley.ns.cloudflare.com DNS Server에게 anacnu.kr을 물어봤는데 알려주지 않습니다. 이 주소뿐만 아니라 모든 것에 응답을 안해줍니다.
PS C:\Users\ygone> nslookup -type=NS anacnu.kr
서버: one.one.one.one
Address: 1.1.1.1
권한 없는 응답:
anacnu.kr nameserver = bradley.ns.cloudflare.com
anacnu.kr nameserver = haley.ns.cloudflare.com
PS C:\Users\ygone> nslookup anacnu.kr bradley.ns.cloudflare.com
서버: bradley.ns.cloudflare.com
Address: 108.162.195.35
이름: anacnu.kr
Address: 168.188.124.140
그 이유는 interactive mode로 nslookup을 사용했기 때문입니다. 위와 같이 nslookup anacnu.kr bradley.ns.cloudflare.com로 요청하면 응답합니다.
nslookup의 interactive mode는 DNS Message의 Recursive query flag를 켭니다. DNS Server에 따라서 이러한 쿼리에 응답하지 않는 경우도 있기 때문입니다.
PS C:\Users\ygone> nslookup -type=NS cnu.ac.kr
서버: one.one.one.one
Address: 1.1.1.1
권한 없는 응답:
cnu.ac.kr nameserver = baekma2.cnu.ac.kr
cnu.ac.kr nameserver = baekma2.chungnam.ac.kr
cnu.ac.kr nameserver = baekma3.cnu.ac.kr
cnu.ac.kr nameserver = baekma.cnu.ac.kr
PS C:\Users\ygone> nslookup
기본 서버: one.one.one.one
Address: 1.1.1.1
> server baekma.cnu.ac.kr
기본 서버: baekma.cnu.ac.kr
Address: 168.188.1.1
> cnu.ac.kr
서버: baekma.cnu.ac.kr
Address: 168.188.1.1
이름: cnu.ac.kr
Address: 168.188.253.130
이번엔 똑같은 방식을 cnu.ac.kr에 대해서 진행했습니다. 이번엔 응답이 잘 옵니다. 왜 Cloudflare는 Authoritative한 DNS Server가 A 레코드를 제공해주지 않는 걸까요?
NS 레코드 가져오기
newworld.cs.umass.edu> nslookup -type=NS nyu.edu
Server: 128.119.240.1
Address: 128.119.240.1#53
Non-authoritative answer:
nyu.edu nameserver = ns2.nyu.org.
nyu.edu nameserver = ns4.nyu.edu.
nyu.edu nameserver = ns1.nyu.net.
Authoritative answers can be found from:
ns2.nyu.org internet address = 128.122.0.76
ns1.nyu.net internet address = 128.122.0.8
ns4.nyu.edu internet address = 216.165.87.102
ns4.nyu.edu has AAAA address 2607:f600:2001:6100::135
nslookup을 통해 nyu.edu의 NS 레코드를 가져오고 있습니다. newworld.cs.umass.edu라는 host는 UMass라는 대학 캠퍼스 내부에 위치하고, 이 host가 속한 네트워크에서 local name server는 128.119.240.1입니다.
NS 레코드에서 (ns2.nyu.org., ns4.nyu.edu., ns1.nyu.net.) 이렇게 세 개의 DNS 서버의 hostname을 알 수 있습니다. 추가적으로, 편의 상 해당 hostname의 IP 주소도 같이 알려주고 있습니다.
Reverse DNS lookup
PS C:\Users\ygone> nslookup cnu.ac.kr
서버: one.one.one.one
Address: 1.1.1.1
권한 없는 응답:
이름: cnu.ac.kr
Address: 168.188.253.130
PS C:\Users\ygone> nslookup -type=ptr 168.188.253.130
서버: one.one.one.one
Address: 1.1.1.1
권한 없는 응답:
130.253.188.168.in-addr.arpa name = www.cnu.ac.kr
130.253.188.168.in-addr.arpa name = cnu.ac.kr
신기하게도 nslookup 168.188.253.130을 통해서 IP 주소로 거꾸로 hostname을 가져올 수도 있습니다.
RFC 1035 IN-ADDR.ARPA domain에서 정의한 주소 형식이고 기존 IP를 뒤집은 다음에 in-addr.arpa를 붙이고 있습니다.
-
Run nslookup to obtain the IP address of the web server for the Indian Institute of Technology in Bombay, India:
www.iitb.ac.in. What is the IP address ofwww.iitb.ac.in?PS C:\Users\ygone> nslookup www.iitb.ac.in 서버: one.one.one.one Address: 1.1.1.1 권한 없는 응답: 이름: www.iitb.ac.in Address: 103.21.124.133www.iitb.ac.in도메인의 IP 주소는103.21.124.133입니다. -
What is the IP address of the DNS server that provided the answer to your nslookup command in question 1 above?
응답해준 서버는 Coludflare의 DNS Sever입니다. IP 주소는
1.1.1.1입니다. -
Did the answer to your nslookup command in question 1 above come from an authoritative or non-authoritative server?
non-authoritative 서버입니다. 권한 없는 응답이라고 했기 때문입니다.
-
Use the nslookup command to determine the name of the authoritative name server for the iit.ac.in domain. What is that name? (If there are more than one authoritative servers, what is the name of the first authoritative server returned by nslookup)? If you had to find the IP address of that authoritative name server, how would you do so?
PS C:\Users\ygone> nslookup -type=NS iitb.ac.in 서버: one.one.one.one Address: 1.1.1.1 권한 없는 응답: iitb.ac.in nameserver = dns1.iitb.ac.in iitb.ac.in nameserver = dns2.iitb.ac.in iitb.ac.in nameserver = dns3.iitb.ac.in실제로
iit.ac.indomain의 Authoritative DNS Server는dns1.iitb.ac.in,dns2.iitb.ac.in,dns3.iitb.ac.in입니다.이 DNS Server의 IP 주소가 필요하면 domain이기 때문에 당연히 nslookup을 이용하면 됩니다.
PS C:\Users\ygone> nslookup dns1.iitb.ac.in 서버: one.one.one.one Address: 1.1.1.1 권한 없는 응답: 이름: dns1.iitb.ac.in Address: 103.21.125.129
Tracing DNS with Wireshark
ipconfig /flushdns
OS의 DNS 캐시를 모두 지우고 운영체제의 DNS 캐시도 모두 지운 후에 http://gaia.cs.umass.edu/kurose_ross/에 브라우저로 접속하여 DNS 패킷을 캡쳐합니다.
| No. | Time | Source | Destination | Proto | Length | Info |
|---|---|---|---|---|---|---|
| 162 | 0.375587 | 192.168.100.16 | 1.0.0.1 | TCP | 62 | 57279 → 53 [SYN] Seq=0 Win=65535 Len=0 MSS=1364 SACK_PERM |
| 165 | 0.379931 | 1.0.0.1 | 192.168.100.16 | TCP | 62 | 53 → 57279 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 |
| 166 | 0.379976 | 192.168.100.16 | 1.0.0.1 | TCP | 54 | 57279 → 53 [ACK] Seq=1 Ack=1 Win=65535 Len=0 |
| 167 | 0.380034 | 192.168.100.16 | 1.0.0.1 | TCP | 56 | 57279 → 53 [PSH, ACK] Seq=1 Ack=1 Len=2 (reassembled in 168) |
| 168 | 0.380059 | 192.168.100.16 | 1.0.0.1 | DNS | 89 | Standard query 0x66c9 A gaia.cs.umass.edu |
| 177 | 0.384168 | 1.0.0.1 | 192.168.100.16 | TCP | 60 | 53 → 57279 [ACK] Seq=1 Ack=3 Len=0 |
| 178 | 0.384298 | 1.0.0.1 | 192.168.100.16 | TCP | 60 | 53 → 57279 [ACK] Seq=1 Ack=38 Len=0 |
| 179 | 0.385967 | 1.0.0.1 | 192.168.100.16 | DNS | 107 | Standard query response 0x66c9 A gaia.cs.umass.edu A 128.119.245.12 |
| 180 | 0.386037 | 192.168.100.16 | 1.0.0.1 | TCP | 54 | 57279 → 53 [FIN, ACK] Seq=38 Ack=54 Len=0 |
| 191 | 0.390187 | 1.0.0.1 | 192.168.100.16 | TCP | 60 | 53 → 57279 [FIN, ACK] Seq=54 Ack=39 Len=0 |
| 192 | 0.390212 | 192.168.100.16 | 1.0.0.1 | TCP | 54 | 57279 → 53 [ACK] Seq=39 Ack=55 Len=0 |
-
Locate the first DNS query message resolving the name gaia.cs.umass.edu. What is the packet number in the trace for the DNS query message? Is this query message sent over UDP or TCP?
0000 70 5d cc e8 b3 b8 a8 a1 59 f1 df 23 08 00 45 00 p]......Y..#..E. 0010 00 4b 98 eb 40 00 80 06 00 00 c0 a8 64 10 01 00 .K..@.......d... 0020 00 01 df bf 00 35 42 9e 99 70 dd 15 86 5b 50 18 .....5B..p...[P. 0030 ff ff 25 f7 00 00 66 c9 01 00 00 01 00 00 00 00 ..%...f......... 0040 00 00 04 67 61 69 61 02 63 73 05 75 6d 61 73 73 ...gaia.cs.umass 0050 03 65 64 75 00 00 01 00 01 .edu.....168번 패킷이 DNS 메시지를 보내는 패킷입니다. 이전은 TCP 3-way handshake 패킷입니다. DNS 패킷이 길지도 않은데 왜 167, 168번 패킷으로 나눠서 보냈을까요?
DNS는 UDP 위에서 동작하는 줄 알았는데 TCP 위에서 동작하고 있습니다.
-
Now locate the corresponding DNS response to the initial DNS query. What is the packet number in the trace for the DNS response message? Is this response message received via UDP or TCP?
0000 a8 a1 59 f1 df 23 70 5d cc e8 b3 b8 08 00 45 00 ..Y..#p]......E. 0010 00 5d c8 67 40 00 37 06 55 7a 01 00 00 01 c0 a8 .].g@.7.Uz...... 0020 64 10 00 35 df bf dd 15 86 5b 42 9e 99 93 50 18 d..5.....[B...P. 0030 ff ff 18 1a 00 00 00 33 66 c9 81 80 00 01 00 01 .......3f....... 0040 00 00 00 00 04 67 61 69 61 02 63 73 05 75 6d 61 .....gaia.cs.uma 0050 73 73 03 65 64 75 00 00 01 00 01 c0 0c 00 01 00 ss.edu.......... 0060 01 00 00 0d 58 00 04 80 77 f5 0c ....X...w..179번 패킷이 DNS Query에 대한 응답을 담고 있습니다.
80 77 f5 0c4바이트이고,Address: 128.119.245.12입니다. 마찬가지로 응답도 TCP 위에서 도착했습니다. -
What is the destination port for the DNS query message? What is the source port of the DNS response message?
브라우저의 포트는 57279이고, DNS 서버의 포트는 53입니다.
-
To what IP address is the DNS query message sent?
Cloudflare의 DNS Server의 주소인
1.0.0.1입니다. -
Examine the DNS query message. How many “questions” does this DNS message contain? How many “answers” answers does it contain?
DNS query message의 필드를 확인해보니
Questions는 1이고Answer RRs는 0입니다. -
Examine the DNS response message to the initial query message. How many “questions” does this DNS message contain? How many “answers” answers does it contain?
DNS response message의 필드를 확인해보니
Questions는 1이고Answer RRs는 1입니다. -
The web page for the base file http://gaia.cs.umass.edu/kurose_ross/ references the image object http://gaia.cs.umass.edu/kurose_ross/header_graphic_book_8E_2.jpg, which, like the base webpage, is on gaia.cs.umass.edu.
-
What is the packet number in the trace for the initial HTTP GET request for the base file http://gaia.cs.umass.edu/kurose_ross/?
-
What is the packet number in the trace of the DNS query made to resolve gaia.cs.umass.edu so that this initial HTTP request can be sent to the gaia.cs.umass.edu IP address?
-
What is the packet number in the trace of the received DNS response? What is the packet number in the trace for the HTTP GET request for the image object http://gaia.cs.umass.edu/kurose_ross/header_graphic_book_8E2.jpg?
-
What is the packet number in the DNS query made to resolve gaia.cs.umass.edu so that this second HTTP request can be sent to the gaia.cs.umass.edu IP address? Discuss how DNS caching affects the answer to this last question.
웹 서버가 301로 응답해서 자동으로 https로 연결되게해서 캡쳐를 못했습니다. 가장 처음에 IP 주소를 얻을 떄 DNS Query를 한 번 하고 그 이후에는 알아낸 IP로 TCP Connection을 한 번 열어서 추가적인 DNS Query를 하지 않았을 것 같습니다.
-
nslookup A 레코드 패킷 캡쳐
PS C:\Users\ygone> nslookup www.cs.umass.edu
서버: one.one.one.one
Address: 1.1.1.1
권한 없는 응답:
이름: www.cs.umass.edu
Address: 128.119.240.9
| No. | Time | Source | Destination | Proto | Length | Info |
|---|---|---|---|---|---|---|
| 124 | 1.226427 | 192.168.100.16 | 1.1.1.1 | DNS | 76 | Standard query 0x0002 A www.cs.umass.edu |
| 125 | 1.453531 | 1.1.1.1 | 192.168.100.16 | DNS | 92 | Standard query response 0x0002 A www.cs.umass.edu A 128.119.240.9 |
0000 70 5d cc e8 b3 b8 a8 a1 59 f1 df 23 08 00 45 00 p]......Y..#..E.
0010 00 3e e3 d5 00 00 80 11 00 00 c0 a8 64 10 01 01 .>..........d...
0020 01 01 e9 f7 00 35 00 2a 26 f6 00 02 01 00 00 01 .....5.*&.......
0030 00 00 00 00 00 00 03 77 77 77 02 63 73 05 75 6d .......www.cs.um
0040 61 73 73 03 65 64 75 00 00 01 00 01 ass.edu.....0000 a8 a1 59 f1 df 23 70 5d cc e8 b3 b8 08 00 45 00 ..Y..#p]......E.
0010 00 4e 69 ce 40 00 37 11 b3 16 01 01 01 01 c0 a8 .Ni.@.7.........
0020 64 10 00 35 e9 f7 00 3a 19 c8 00 02 81 80 00 01 d..5...:........
0030 00 01 00 00 00 00 03 77 77 77 02 63 73 05 75 6d .......www.cs.um
0040 61 73 73 03 65 64 75 00 00 01 00 01 c0 0c 00 01 ass.edu.........
0050 00 01 00 00 0e 10 00 04 80 77 f0 09 .........w..-
What is the destination port for the DNS query message? What is the source port of the DNS response message?
Powershell의 포트는 59895이고 DNS Server의 포트는 53입니다.
-
To what IP address is the DNS query message sent? Is this the IP address of your default local DNS server?
1.1.1.1이고, 제 컴퓨터의 기본 Local DNS Server로 등록되어있습니다.
-
Examine the DNS query message. What “Type” of DNS query is it? Does the query message contain any “answers”?
쿼리 메시지에는
Answer RRs필드가 0이고,Queries의 타입은 A입니다. -
Examine the DNS response message to the query message. How many “questions” does this DNS response message contain? How many “answers”?
응답 메시지에는
Questions가 1이고Answer RRs는 1입니다.
nslookup NS 레코드 패킷 캡쳐
PS C:\Users\ygone> nslookup -type=NS umass.edu
서버: one.one.one.one
Address: 1.1.1.1
권한 없는 응답:
umass.edu nameserver = ns3.umass.edu
umass.edu nameserver = ns1.umass.edu
umass.edu nameserver = ns2.umass.edu
| No. | Time | Source | Destination | Proto | Length | Info |
|---|---|---|---|---|---|---|
| 56 | 0.827827 | 192.168.100.16 | 1.1.1.1 | DNS | 69 | Standard query 0x0002 NS umass.edu |
| 89 | 1.056779 | 1.1.1.1 | 192.168.100.16 | DNS | 123 | Standard query response 0x0002 NS umass.edu NS ns3.umass.edu NS ns1.umass.edu NS ns2.umass.edu |
0000 70 5d cc e8 b3 b8 a8 a1 59 f1 df 23 08 00 45 00 p]......Y..#..E.
0010 00 37 e3 e8 00 00 80 11 00 00 c0 a8 64 10 01 01 .7..........d...
0020 01 01 e0 6c 00 35 00 23 26 ef 00 02 01 00 00 01 ...l.5.#&.......
0030 00 00 00 00 00 00 05 75 6d 61 73 73 03 65 64 75 .......umass.edu
0040 00 00 02 00 01 .....0000 a8 a1 59 f1 df 23 70 5d cc e8 b3 b8 08 00 45 00 ..Y..#p]......E.
0010 00 6d 92 b3 40 00 37 11 8a 12 01 01 01 01 c0 a8 .m..@.7.........
0020 64 10 00 35 e0 6c 00 59 ac 26 00 02 81 80 00 01 d..5.l.Y.&......
0030 00 03 00 00 00 00 05 75 6d 61 73 73 03 65 64 75 .......umass.edu
0040 00 00 02 00 01 c0 0c 00 02 00 01 00 00 0e 10 00 ................
0050 06 03 6e 73 33 c0 0c c0 0c 00 02 00 01 00 00 0e ..ns3...........
0060 10 00 06 03 6e 73 31 c0 0c c0 0c 00 02 00 01 00 ....ns1.........
0070 00 0e 10 00 06 03 6e 73 32 c0 0c ......ns2..-
To what IP address is the DNS query message sent? Is this the IP address of your default local DNS server?
1.1.1.1이고, 제 컴퓨터의 기본 Local DNS Server로 등록되어있습니다.
-
Examine the DNS query message. How many questions does the query have? Does the query message contain any “answers”?
쿼리 메시지에는
Questions가 1이고Answer RRs는 0입니다. -
Examine the DNS response message (in particular the DNS response message that has type “NS”). How many answers does the response have? What information is contained in the answers? How many additional resource records are returned? What additional information is included in these additional resource records (if additional information is returned)?
Answer RRs이 3입니다. 세 개의 NS 레코드 안에는Name Server필드 외에도Time to live등이 있습니다.Additional RRs는 0입니다.