Transcript
This lab is tied to the PDF file for DNS Lab and Wireshark. You should walk through the PDF lab and answer the questions here. I have copied the questions from the PDF here. Please be sure you work through all the steps. You need to start and put these materials together to see the interaction with the Protocols and the Tools. This lab deals with types of DNS Servers. We are going to be working with some of the examples in the PDF and using different servers to copy and test the results. First let’s determine what the types of DNS Servers mean. A queried DNS server can be a root DNS server, a top-level-domain DNS server, an authoritative DNS server, or an intermediate DNS server Root DNS Server—Servers which resolve the major collection under the final DOT domain, such as .com, .edu, .net…. Top-Level-Domain DNS server— responsible for com, org, net, edu, aero, jobs, museums, and all top-level country domains, e.g.: uk, fr, ca, jp, Network Solutions maintain servers for .com TLD. For example, Educause maintains the TLD for its .edu TLD Authoritative DNS Server-- organization’s own DNS server(s), providing authoritative hostname to IP mappings for organization’s named hosts Intermediate DNS Server—DNS servers located within the organization, but not authoritative Summary Formats for NSLOOKUP COMMAND—follow the directions in the PDF. nslookup -type=NS (non authoritative) nslookup -type=A (use the authoritative server) nslookup –type=MX (Find the mail server) nslookup options server a server b (look up the IP for server a using the server b to start) Use the options to see what you are requesting. Work through the first part of the PDF pages 1-3. At the end of page 3 there are questions that show you understand how NSLOOKUP works and you will answer these. Questions from Part 1 of the PDF. You are going to do some testing with NSlookup. Answer the following questions (which are the same as the end of page 3 in the PDF). Do the following (and write down the results and show screen shots of your results) Find a university that is in Asia. What is the URL for the university? Using this URL run nslookup to obtain the IP address of the Web server. 781050-115570 Find a university in Europe. What is the URL for the University? Run nslookup to determine the authoritative DNS servers for that university in Europe. 73342588900 Run nslookup so that one of the DNS servers obtained in Question 2 is queried for the mail servers for gmail. Look at the options in the PDF document. 104775069850 Work through PART 2 to become more familiar with the options in IPCONFIG. You may already feel comfortable with this. Part 3—These are the questions associated with part 3 of the PDF. It is meant to bring things together. Now you are familiar with nslookup and ipconfig, we’re ready to get down to some serious business. Let’s first capture the DNS packets that are generated by ordinary Websurfing activity. Use ipconfig to empty the DNS cache in your host. Open your browser and empty your browser cache. (With Internet Explorer, go to Tools menu and select Internet Options; then in the General tab select Delete Files.) Open Wireshark and enter “ip.addr == your_IP_address” into the filter, where you obtain your_IP_address with ipconfig. This filter removes all packets that neither originate nor are destined to your host. Start packet capture in Wireshark. With your browser, visit the Web page: http://www.irtf.org Stop packet capture. Answer the following questions: (Don’t forget to write the answers and show the captures in screen shots) -9525781050 Locate the DNS query and response messages. Are then sent over UDP or TCP? Sent over UDP What is the destination port for the DNS query message? What is the source port of DNS response message? The destination port is 53 and the source port is 52552. To what IP address is the DNS query message sent? Use ipconfig to determine the IP address of your local DNS server. Are these two IP addresses the same? It is sent to 139.84.11.205 which is my IP address of one of the DNS servers. Examine the DNS query message. What “Type” of DNS query is it? Does the query message contain any “answers”? (Refer back to the PPT slides from Chapter 2 section 2.5 on DNS Message types.) It is a type A and it does not contain any answers Examine the DNS response message. How many “answers” are provided? What do each of these answers contain? There were 2 answers containing information about the name of the host, the type of address, class, the TTL, the data length and the IP address. Consider the subsequent TCP SYN packet sent by your host. Does the destination IP address of the SYN packet correspond to any of the IP addresses provided in the DNS response message? The first SYN packet was sent to 209.173.57.180 which corresponds to the first IP address provided in the DNS response message. 10. This web page contains images. Before retrieving each images, does your host issue new DNS queries? a. NO -318051644380 Read the PDF File for specific directions related to the next set of questions. What is the destination port for the DNS query message? What is the source port of DNS response message? The destination port is 53 and the source port is 51445. To what IP address is the DNS query message sent? Is this the IP address of your default local DNS server? It is my default DNS server IP address.139.84.11.205 Examine the DNS query message. What “Type” of DNS query is it? Does the query message contain any “answers”? It is a type B. It contains no answers Examine the DNS response message. How many “answers” are provided? What do each of these answers contain? No answers 55660470397
