0.1 # Exercises: DNS 1.1

0.2 Verify the resolv.conf configuration on your workstation.

cat /etc/resolv.conf

The output should look like

nameserver 10.10.0.254
domain ws.nsrc.org
search ws.nsrc.org

0.3 Issue the following DNS queries using 'dig'

Run each command below, look for the "ANSWER SECTION" and write down the result. Make a note of the TTL as well.

Repeat the command. Is the TTL the same as in the first try?

Are the responses Authoritative?

COMMAND                         RESULT              TTL (1st)   TTL (2nd)
===========================     ================    =========== ==========

dig nsrc.org. a                 ________________    ___________ __________
dig www.tiscali.co.uk. a        ________________    ___________ __________                  
dig afnog.org. mx               ________________    ___________ __________      
dig www.afrinic.net. aaaa       ________________    ___________ __________      
dig psg.com. aaaa               ________________    ___________ __________      
dig <domain of your choice> a   ________________    ___________ __________  
dig <domain of your choice> mx  ________________    ___________ __________      
dig tiscali.co.uk. txt          ________________    ___________ __________      
dig ripe.net. txt               ________________    ___________ __________      
dig afnog.org. txt              ________________    ___________ __________          
dig geek.tiscali.co.uk. a       ________________    ___________ __________

Now send some queries to another caching server. How long did it take each answer to be received?

COMMAND                                         RESULT
===========================                     ==============

dig @8.8.8.8 psg.com. a                         ______________
dig @nsrc.org google.com. a                     ______________
dig @zoe.dns.gh. www.afrinic.net. aaaa          ______________
dig @<a-server-of-yours> <domain-of-yours> a    ______________

0.4 Reverse DNS lookups

Now try some reverse DNS lookups. Remember to reverse the four parts of the IP address, add '.in-addr.arpa.', and ask for a PTR resource record.

(For 10.10.0.250)

dig 250.0.10.10.in-addr.arpa. ptr

Repeat for an IP address of your choice.

Now try the short form of dig using the '-x' flag for reverse lookups:

dig -x 196.1.95.15
dig -x 2001:42d0::200:80:1
dig -x 2001:468:d01:103::80df:9d13
dig @<server-of-your-choice> -x <ip-address-of-your-choice>

0.5 Use tcpdump to show DNS traffic

In a separate window, run the following command (you must be 'root')

# tcpdump -n -s 1500 -i eth0 udp port 53

This shows all packets going in and out of your machine for UDP port 53 (DNS). Now go to another window and repeat some of the 'dig' queries from earlier. Look at the output of tcpdump, check the source and destination IP address of each packet