In this segment, we're going to talk a little bit more about the domain name system.
And we're going to look at some, some other ways to analyze the DNS process
so that we can troubleshoot for problems.
So, one of the key concepts with looking at DNS is that understanding how it resolves is key
and if you understand how the client resolves the DNS,
and how it provides its host information or domain information,
you're starting in a place where you can now
work out into the hierarchy of DNS and understand
more concepts of how it works.
So as an example, as you can see here
clients make a request by using a DNS name.
So, quite simply if I wanted to get to the INE website,
I could put in www.ine.com into a web browser.
However, what that's really doing is it's resolving that and it's really telling the machine that it's
75.140.41.225 and to go to that public IP address to access that website.
So again, we can do a couple of different things from the client if the DNS server does not
work correctly or you suspect there's a problem with the DNS server.
You could go into the local host file of your system.
And you can add that IP address to, to domain name resolution
and it will look at that host file as well as the DNS server
to try to figure out that resolution or resolve it and will send you there.
So that's a quick way to find if you have a problem
with DNS on your network is to just quickly add that information.
That information is also in what's called an A record on your DNS server.
That A record could have an issue where it's not configured correctly or it's just not there,
or it was configured in one zone
and it had not yet replicated to the zone that you're using.
And therefore, you're not able to resolve.
So, there's quite a few reasons why DNS will not work for you
but you have to remember what the DNS resolution process is
so that you can start to troubleshoot with it.
Know where to put your analyzer and really see what it is that you're trying to find because
you have to know what the query looks like and you have to know, for example, point the records.
What is it pointing at, if you have a reversed zone look-up, what does that mean?
And you could see all that stuff within the capture. And we will look at that.
So also, when the client uses FQDN which is a fully qualified domain name,
the resource can be found in excess.
So, it's not just necessarily the host name.
If your machine 1 at a domain, you would want the full domain name to be able to resolve.
So, there'll be times where you're trying to log in to something
and it'll tell you, you have incorrect information
you might have to add the entire fully qualified domain name to be able to access that resource.
So, these are some client related issues that you may come across.
What can you see in Wireshark?
Very easily you could see the failures that are taking place
from the client to the server, as well as from server to other servers.
So, one of the things that you want to consider here,
it's been the mantras of the entire course is placement.
You want to make that if you're looking to place your
Wireshark analyzer on the network to be able to capture this traffic
where exactly are you going to place it.
So for this example, we placed it on a machine
that was trying to make a simple web query.
And when we did this, we were able to see
specifics on the client trying to access the server,
and the whole process of taking, you know,
the query and trying to resolve the, the domain name
to the IP address and back and forth, so that we can access the resource.
But as you could see, there's a lot of packets here and
we're not quite sure what's taking place in this entire, this entire stream here.
So let's take a look at something a little bit more in depth.
Let's take a look at the stream.
So we learned this in a, in earlier module
where we took a look at TCP and UDP streams,
and if you recall, what we were able to find from this
is if we look at the entire stream from start to finish of a conversation,
we were able to see packet by packet what was really taking place
and by doing so, we were able to pull some information out of it.
So some of the information that we were able to pull from the stream,
was a - we were able to see the entire conversation,
to be able to see if there's anything inside it.
For example, any anomalies that might have popped-up
that may have flagged an issue for you to look at further.
You could have seen false record information.
You can see the zone information. Maybe you're getting information from the incorrect zone.
Maybe you have an incorrect name server configured.
Sometimes there's multiples, there's a primary, a secondary, a tertiary.
Maybe you want to see which ones were configured and which ones were answering.
So there's a lot of information that you can pull from the stream.
We will do this live so that you can see specifically
how to do the stream but here, if you go into the configuration,
and you look at follow UDP stream,
we were able to see the entire conversation as it took place from start to finish,
where we were trying to get in this instance, we were trying to get to google.com.
We had some information return from us from 104.9.192.66.in-addr.arpa
and that is a reversed zone.
We were able to then further look up other queries
and see that it was answering back based on that reversed look-up.
So, there's a lot of information that you can pull from the stream.
Remember what we learned in the last module.
How to go into the details to see if it's responding from the client.
You were getting recursive queries.
And or you can look at the entire segment as a whole,
and see specifically what the entire conversation or the communication was showing you.