Unlock document.
This document is partially blurred.
Unlock all pages and 1 million more documents.
Get Access
Wireshark Lab: DNS
SOLUTION
Supplement)to)Computer)Networking:)A)Top3Down)
Approach,)6th)ed.,)J.F.)Kurose)and)K.W.)Ross)
)
)
)
1. Run nslookup to obtain the IP address of a Web server in Asia. What is its IP address?
ANSWER: I performed nslookup for www.rediff.com. Its IP address is 208.184.138.70
)
)
Screenshot taken for question 1
)
2. Run nslookup to determine the authoritative DNS servers for a university in Europe. What
is its IP address. ANSWER: I performed nslookup for a European University in Ioannina
Greece. Its IP address is 128.238.29.22
)
)
Screenshot taken for question 2
)
3. Run nslookup so that one of the DNS servers obtained in Question 2 is queried for the mail servers for
)
PART 3a
)
)
)
Screenshot for DNS query Screenshot for DNS response
)
4. Locate the DNS query and response messages. Are then sent over UDP or TCP? ANSWER: They
)
5. What is the destination port for the DNS query message? What is the source port of DNS
)
)
Screenshot for ipconfig –all
)
6. To what IP address is the DNS query message sent? Use ipconfig to determine the IP address of
)
)
7. Examine the DNS query message. What “Type” of DNS query is it? Does the query
)
8. Examine the DNS response message. How many “answers” are provided? What do each
of these answers contain? ANSWER: There were 2 answers containing information about
)
9. Consider the subsequent TCP SYN packet sent by your host. Does the destination IP
address of the SYN packet correspond to any of the IP addresses provided in the DNS
)
10. This web page contains images. Before retrieving each image, does your host issue new
PART 3b
)
)
Screenshot for DNS query Screenshot for DNS response
)
11. What is the destination port for the DNS query message? What is the source port of DNS
)
12. To what IP address is the DNS query message sent? Is this the IP address of your default local
)
13. Examine the DNS query message. What “Type” of DNS query is it? Does the query message
)
14. Examine the DNS response message. How many “answers” are provided? What do each of
these answers contain? ANSWER: The response DNS message contains one answer containing the
15. Provide a screenshot.
PART 3c
19. Provide a screenshot.
)
)
)
)
Screenshot for DNS response
)
16. To what IP address is the DNS query message sent? Is this the IP address of your default
)
17. Examine the DNS query message. What “Type” of DNS query is it? Does the query
)
18. Examine the DNS response message. What MIT nameservers does the response message
provide? Does this response message also provide the IP addresses of the MIT nameservers?
ANSWER: The nameservers are bitsy, strawb and w20ns. We can find their IP addresses if we
PART 3d
23. Provide a screenshot.
)
)
)
)
Screenshot for DNS response
)
20. To what IP address is the DNS query message sent? Is this the IP address of your default local DNS server?
)
21. Examine the DNS query message. What “Type” of DNS query is it? Does the query message contain any
)
22. Examine the DNS response message. How many “answers” are provided? What does each of these answers
)
Answers )
www.aiit.or.kr: type A, class inet, addr 222.106.36.102
Name: www.aiit.or.kr
