Wireshark Lab: DNS. 1. Run nslookup to obtain the IP address of a Web server in Asia. What is the IP address of that server?

Transcription

1 Rick Shingu Nick Ishihara 11/30/14 Wireshark Lab: DNS 1. nslookup 1. Run nslookup to obtain the IP address of a Web server in Asia. What is the IP address of that server? Ran the command nslookup The Address is and the aliases are 2. Run nslookup to determine the authoritative DNS servers for a university in Europe. Ran the command nslookup type=ns Primary name server = nighthawk.dns.ox.ac.uk Responsible maile addr = hostmaster.ox.ac.uk 3. Run nslookup so that one of the DNS servers obtained in Question 2 is queried for the mail servers for Yahoo! mail. What is its IP address? The IP address that was pulled before timing out and the address was Tracing DNS with Wireshark 4. Locate the DNS query and response messages. Are then sent over UDP or TCP? Looking at the information provided by the DNS query, the response messages are sent over UDP 5. What is the destination port for the DNS query message? What is the source port of DNS response message? The destination port for the DNS query message is 53. The source port for the DNS response message is also To what IP address is the DNS query message sent? Use ipconfig to determine the IP address of your local DNS server. Are these two IP addresses the same? The IP addresses are the same. The message is sent to my local DNS server. The number Is Examine the DNS query message. What Type of DNS query is it? Does the query

2 According to my system the type is Type A Standard Query. There does not seem to be an answer. 8. Examine the DNS response message. How many answers are provided? What do each of these answers contain? The response contained two answers and each answer contains information as followed: Name, Type, Class, Time, Data, and Address. 9. Consider the subsequent TCP SYN packet sent by your host. Does the destination IP address of the SYN packet correspond to any of the IP addresses provided in the DNS response message? The SYN packet was sent to the corresponding IP address that was given by the DNS response. This happens to be the first SYN packet as well as the first IP address. 10. This web page contains images. Before retrieving each image, does your host issue new DNS queries? No, the host does not issue a new DNS query. 11. What is the destination port for the DNS query message? What is the source port of DNS response message? As before the destination port of the DNS query message is 53 and the source port for the DNS response is also To what IP address is the DNS query message sent? Is this the IP address of your default local DNS server? Using the ipconfig /all command my default DNS is and this is the same address that is the DNS query message is sent. 13. Examine the DNS query message. What Type of DNS query is it? Does the query The DNS query message does not contain a answer as a type A standard query. 14. Examine the DNS response message. How many answers are provided? What do each of these answers contain? It contains one answer and the answer contains a host, type of address, the class, IP address and the data length.

3 15. Provide a screenshot. 16. To what IP address is the DNS query message sent? Is this the IP address of your default local DNS server? It was sent over to my default DNS server which is Examine the DNS query message. What Type of DNS query is it? Does the query It is a NS DNS query that does not contain any answers much like the type A Standard query. 18. Examine the DNS response message. What MIT name servers does the response message provide? Does this response message also provide the IP addresses of the MIT namesers? The authorized name server was b.akamiedge.met In the additional info with Wireshark it should provide that information.

4 19. Provide a screenshot 20. To what IP address is the DNS query message sent? Is this the IP address of your default local DNS server? If not, what does the IP address correspond to? The query should be sent to the bitsy.mit.edu IP however my system is showing a timeout. 21. Examine the DNS query message. What Type of DNS query is it? Does the query

5 This should take place as a type A standard query as noted in Wireshark. 22. Examine the DNS response message. How many answers are provided? What does each of these answers contain? I got timed out responses. So the message is not present in this one. 23. Provide a screenshot.

6