什么是DNS请求的样子？

我已经看到了HTTP请求的文本表示是什么，但是DNS请求是什么样的？数据中的哪个位置是您尝试查找的URL的位置？另外，如何格式化回应？

这是来自Wireshark的DNS查询的原始转储。

DNS部分以24开头1a：

0000 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00 ........ ......E. 0010 00 3c 51 e3 40 00 40 11 ea cb 7f 00 00 01 7f 00 .<Q.@.@. ........ 0020 00 01 ec ed 00 35 00 28 fe 3b 24 1a 01 00 00 01 .....5.( .;$..... 0030 00 00 00 00 00 00 03 77 77 77 06 67 6f 6f 67 6c .......w ww.googl 0040 65 03 63 6f 6d 00 00 01 00 01 e.com... ..

这里是细节：

 Domain Name System (query) [Response In: 1852] Transaction ID: 0x241a Flags: 0x0100 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...1 .... .... = Recursion desired: Do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries www.google.com: type A, class IN Name: www.google.com Type: A (Host address) Class: IN (0x0001)

repsonse再次从24开始1a：

 0000 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00 ........ ......E. 0010 00 7a 00 00 40 00 40 11 3c 71 7f 00 00 01 7f 00 .z..@.@. <q...... 0020 00 01 00 35 ec ed 00 66 fe 79 24 1a 81 80 00 01 ...5...f .y$..... 0030 00 03 00 00 00 00 03 77 77 77 06 67 6f 6f 67 6c .......w ww.googl 0040 65 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 e.com... ........ 0050 00 05 28 39 00 12 03 77 77 77 01 6c 06 67 6f 6f ..(9...w ww.l.goo 0060 67 6c 65 03 63 6f 6d 00 c0 2c 00 01 00 01 00 00 gle.com. .,...... 0070 00 e3 00 04 42 f9 59 63 c0 2c 00 01 00 01 00 00 ....B.Yc .,...... 0080 00 e3 00 04 42 f9 59 68 ....B.Yh

分解：

 Domain Name System (response) [Request In: 1851] [Time: 0.000125000 seconds] Transaction ID: 0x241a Flags: 0x8180 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...1 .... .... = Recursion desired: Do query recursively .... .... 1... .... = Recursion available: Server can do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 3 Authority RRs: 0 Additional RRs: 0 Queries www.google.com: type A, class IN Name: www.google.com Type: A (Host address) Class: IN (0x0001) Answers www.google.com: type CNAME, class IN, cname www.l.google.com Name: www.google.com Type: CNAME (Canonical name for an alias) Class: IN (0x0001) Time to live: 3 days, 21 hours, 52 minutes, 57 seconds Data length: 18 Primary name: www.l.google.com www.l.google.com: type A, class IN, addr 66.249.89.99 Name: www.l.google.com Type: A (Host address) Class: IN (0x0001) Time to live: 3 minutes, 47 seconds Data length: 4 Addr: 66.249.89.99 www.l.google.com: type A, class IN, addr 66.249.89.104 Name: www.l.google.com Type: A (Host address) Class: IN (0x0001) Time to live: 3 minutes, 47 seconds Data length: 4 Addr: 66.249.89.104

编辑：

请注意，如果您真正的问题是“如何编写DNS服务器？”，那么有两个适当的答案：

不要这样做，使用现有的，例如绑定或dnsmasq
阅读规范

编辑（2）：

该请求是使用Linux机箱上的host发送的：

 host www.google.com

如果你在windows上，你可以使用nslookup

 nslookup www.google.com

DNS请求数据布局在RFC 1035中进行了描述。我觉得把这里的文字复制一下是没有意义的

DNS查询和响应最好使用协议分析器 – Wireshark是一个很好的跨平台工具，可以将请求和响应捕获并parsing到各个部分。这里介绍Firewall.cx中DNS请求和响应的结构。

DNS请求包含指定名称（或者可能有点任意的文本字段）和loggingtypes的问题 – 响应的内容将根据types而变化。大多数的请求是简单的直接查找服务器名称寻找一个IP地址作为响应（typesA），但一些将寻找更多的信息在名称服务器本身（typesNS），邮件logging（typesMX）和其他服务（typesSRV将返回名称，端口，权重和优先级）。 DNS响应包含这些问题的答案，如果请求需要，可能不止一个，而且不总是只是IP地址。

另一个说明 – DNS不解决URL–在大多数涉及URL的情况下，DNS仅用于使客户端系统能够findURL的服务器部分的IP地址，而其他一切都由其他协议处理。

如果您可以访问Linux机器，则可以运行dig命令执行DNS查找。该实用程序执行查找并返回名称服务器响应的内容。例如：

 ; <<>> DiG 9.6.1-P2 <<>> serverfault.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32383 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;serverfault.com. IN A ;; ANSWER SECTION: serverfault.com. 55961 IN A 69.59.196.211 ;; Query time: 21 msec ;; SERVER: 68.87.64.150#53(68.87.64.150) ;; WHEN: Sun Aug 22 09:21:35 2010 ;; MSG SIZE rcvd: 49

从“HEADER”部分开始的所有内容都是从名称服务器返回的内容。我假设这就是你所指的文本格式，因为这不是实际数据包的格式，而是被返回的文本。