In our next module, we will be discussing
the capturing and analyzing of DNS.
So, DNS, the domain name system is a
hierarchal system used to help you to use
common friendly names instead of memorizing
dozens of IP addresses to get to resources.
It also allows for easy configuration.
So if you always have a resource record or any record
where you have a host name defined
you can change the IP address and refresh your record
and it allows you to be able to reconfigure things on your network pretty easily.
However, a lot of things can go wrong with DNS.
And since the system is quite complex,
been around for a long time, UNIX based bind.
Microsoft has its own version of DNS, very commonly used.
There's a lot of configuration, there's a lot of things
that could happen from one point to another.
For example, a DNS server sending its information
using it as a forwarder, forwarder to another DNS server.
These types of things could cause issues.
If you had problems with the transferring of zones,
if you had stale records, there's just so many things that could take place.
Whereas we can use Wireshark to start isolating and troubleshooting these issues.
So, DNS, the domain name system,
sometimes you see it as the domain name servers
that's generally, if it's the domain name server's on a Window system.
Again, it will allow you to resolve IP addresses to host names.
Friendly, fully qualified domain names
so that you can access a website by
saying, INE.com instead of memorizing
and having to use the IP address.
So, very commonly used. We can use Wireshark to filter the data
via IP address or domain name.
And or port, UDP 53 for queries and
TCP 53 for zone transfers.
And you can also review the stream
which we will look at to be able to ascertain any problems within it.
And see if there's anything that is not working correctly.
We'll talk about recursive queries and
how that can be an issue, how to find that in Wireshark,
and some other information that may be helpful to you.
So that being said, one of the most common things here,
in here we have a simple Linux dig query.
Essentially, if you did a DNS look up on Windows
or you did a dig on a Unix or Linux box,
you're going to get your DNS server to respond to you so that you know you can use DNS.
It doesn't mean that DNS, the DNS server is configured correctly,
it'll give the information that you needed.
It just means that you are configured to and can use specifically a DNS server.
You can use tshark to run by the command-line.
And you can do a dig and then you can run a tshark and you can capture the DNS query.
We look at tshark in an earlier module.
And by doing so, we were able to see some packets
transfer over the network, and we actually did a dig at that time to generate the traffic.
But this is a way that you can do it within tshark.
And or if you're looking at the Wireshark GUI which we will do momentarily.
Regardless of tshark or Wireshark in GUI form,
you could find quite a few things like
a problem with a failed DNS server, maybe there's a problem where
the information is stale or poisoned and is giving you incorrect information
or the wrong DNS server is replying.
So there's quite a few things that we can see here.
And when we open up a capture, we can see specifically how DNS operates.
So in this capture, we just did some simple requests
and we wanted to find a website. Here we look for google.com,
and by doing so, we got the response.
And if we drill down, we can see specifically, here, that it was a recursive request.
And by looking at the recursion, let's explain what that means really quick.
When you do a recursive name query,
the client will ask the DNS server to respond
and it will ask the resource record, the resource record,
the RR or it will get an error message
that the record and or that domain may not exist.
So, it's basically the client asking for information
and we can see that in the capture here as a recursion desired.
We saw that the server here did respond
and gave it the information and was able to allow this SNTP to send email.
So as we can see, we continuously see that the recursions take place.
And the, here we could see that the recursion was available and the server did reply.
So that is the quick way to find if your DNS server is actually responding
to the clients as, by looking into the capture.
Capture DNS queries, we could see it's using UDP 453.
And we could see from inside the flags of the capture
that's specifically, it was doing a recursive query.
And it got the response it needed.
So as an example, if it wasn't responding
then you would continuously see the queries
but you would never see the answer back.
So that's one way to see that you have possibly
a problem with the server itself or the information on the server
that it's not able to respond to your request.
And here, as you could see, we did the same thing with tshark.
And we were looking and we saw the, the recursive queries.
We were not seeing an answer back
and that's how we found that we were having some type of client to DNS server issue
through it not getting information back that it needed.
It did not have the record and therefore,
it was not able to communicate on the network.