©

L

T

O

B

R

P

P

© 2013 Cisco and

Lab - Us

Topology

Objectives

Part 1: Re

Part 2: Us

Part 3: An

Backgroun

If you havnetwork oyou type aYour PC’sas the traDNS quer

In this labprotocol. Y

Note: This

Required R

1 PC (Win

Part 1: R

In Part 1, addressesDNS servbe used in

Part 2: U

In Part 2, UDP trans

d/or its affiliates.

sing Wir

ecord a PC’s

se Wireshark

nalyze Captu

nd / Scenar

ve ever used tof servers thata website URs DNS server nsport layer pries and respo

b, you will comYou will use W

s lab cannot b

Resources

ndows 7, Vist

Record a

you will use ts of your PC’s

ver IP addressn the following

IP ad

MAC

Defau

DNS

Use Wires

you will set usport protoco

All rights reserve

eshark t

s IP Configur

k to Capture

ured DNS or

rio

the Internet, yt translates us

RL into your brquery and th

protocol. UDPonses are ver

mmunicate witWireshark to e

be completed

a, or XP with

PC’s IP C

the ipconfig /s network intes specified forg parts of this

dress

address

ult gateway IP

server IP add

shark to C

up Wireshark l while comm

ed. This docume

to Exam

ration Inform

DNS Querie

UDP Packet

you have useser-friendly dorowser, your Phe DNS serveP is connectiory small and d

th a DNS servexamine the

d using Netlab

a command

Configura

/all commanderface card (Nr the PC. Recs lab with pac

P address

dress

Capture D

to capture DNunicating with

ent is Cisco Publi

mine a UD

mation

s and Respo

s

d the Domainomain namesPC performs

er’s response onless and dodo not require

ver by sendinDNS query a

b. This lab ass

prompt acces

ation Info

d on your locaNIC), the IP acord this inforcket analysis.

DNS Que

NS query andh a DNS serv

ic.

DP DNS

onses

n Name Systes like www.goa DNS querymake use of es not require

e the overhea

ng a DNS quend response

sumes that yo

ss, Internet ac

ormation

al PC to find address of themation in the

eries and

d response paver.

S Captur

em (DNS). DNoogle.com to ay to the DNS sthe User Date a session sad of TCP.

ery using the Uexchanges w

ou have Inter

ccess, and W

and record thee specified de table provide

Respons

ackets to dem

re

NS is a distriban IP addressserver’s IP adtagram Protocetup as does

UDP transporwith the name

rnet access.

Wireshark insta

e MAC and IPfault gatewayed. The inform

ses

monstrate the

Page 1 of 6

buted s. When ddress. col (UDP) TCP.

rt server.

alled)

P y, and the mation will

use of

L

©

P

S

Lab - Using W

© 2013 Cisco and

a. Click

Note:

b. Selecthat is

c. After s

d. Open

e. Click

Part 3: A

In Part 3, the IP add

Step 1: Filt

a. In the

Note:commWirescommbrows

b. In theand “A

Wireshark to

d/or its affiliates.

the Windows

If Wireshark

ct an interfaces associated w

selecting the

a web brows

Stop to stop

Analyze C

you will examdresses for ww

ter DNS pac

e Wireshark m

If you do notmand prompt wshark capture mand prompt wser.

e packet list paA www.googl

Examine a U

All rights reserve

Start button

is not yet ins

e for Wiresharwith the recor

desired interf

ser and type w

the Wireshar

Captured

mine the UDPww.google.co

ckets.

main window,

t see any resuwindow, type and repeat th

window, you c

ane (top secte.com”. See f

UDP DNS Ca

ed. This docume

and navigate

stalled, it can

rk for capturinrded PC’s IP a

face, click Sta

www.google.

rk capture whe

DNS or U

packets that om.

type dns in th

ults after the Dipconfig /flu

he instructioncan type nslo

ion) of the maframe 4 as an

apture

ent is Cisco Publi

e to the Wires

be downloade

ng packets. Uand Media Ac

art to capture

.com. Press E

en you see G

UDP Pack

were genera

he entry area

DNS filter waushdns to rems in Part 2b –

ookup www.g

ain window, lon example.

ic.

shark program

ed at http://ww

se the Interfaccess Contro

e the packets.

Enter to conti

Google’s home

kets

ated when com

a of the Filter

as applied, clomove all prev–2e. If this dogoogle.com

ocate the pac

m.

ww.wireshark

ace List to chl (MAC) addr

.

inue.

e page.

mmunicating

toolbar. Click

ose the web bious DNS reses not resolvas an alterna

cket that inclu

k.org/downloa

hoose the inteesses in Part

with a DNS s

k Apply or pre

browser and insults. Restart e the issue, in

ative to the we

des “standard

Page 2 of 6

ad.html.

erface t 1.

server for

ess Enter.

n the the n the eb

d query”

L

©

S

Lab - Using W

© 2013 Cisco and

Step 2: Ex

Examine Wiresharkdisplayedin gray.

a. In thethe nuwww.

b. The Efrom yfrom t

Is the

c. In theaddreexam

Can y

Loca

Defa

The IPas the

d. A UDheade

Expanthere randoPort 5from c

Wireshark to

d/or its affiliates.

amine UDP

UDP by usingk capture framin the packet

e packet detaiumber of bytegoogle.com.

Ethernet II lineyour local PCthe default ga

source MAC

e Internet Protess of this DNple, the desti

you pair up th

Device

al PC

ault Gateway

P packet and e data.

P header onlyer is only 16 b

nd the User Dare only four

omly generate53 is a well-knclients.

Examine a U

All rights reserve

P segment u

g a DNS querme 4 in the pat details pane

ls pane, frames to send a D

e displays theC because youateway, becau

C address the

tocol Version S query is 19nation addres

e IP and MAC

header enca

y has four fielbits as depicte

Datagram Profields. The so

ed by the locanown port res

UDP DNS Ca

ed. This docume

using DNS q

ry for www.goacket list panee (middle sect

me 4 had 74 byDNS query to

e source and dur local PC oruse this is the

same as reco

4 line, the IP92.168.1.11, ass is the defa

C addresses f

IP Address

apsulates the

lds: source poed below.

otocol in the pource port nu

al PC using poserved for use

apture

ent is Cisco Publi

query.

oogle.com as e is selected ftion) of the ma

ytes of data oa name serve

destination Mriginated the De last stop bef

orded from Pa

packet Wiresand the destinult gateway. T

for the source

UDP segmen

ort, destinatio

acket details mber in this eort numbers te with DNS. D

ic.

captured by Wfor analysis. Tain window. T

on the wire aser requesting

MAC addresseDNS query. Tfore this quer

art 1 for the lo

shark capturenation IP addThe router is

e and destina

M

nt. The UDP s

on port, length

pane by clickexample is 52hat are not re

DNS servers l

Wireshark. InThe protocolsThe protocol e

s displayed ong the IP addre

es. The sourcThe destinatiory exits the loc

ocal PC?

e indicates tharess is 192.16the default ga

ation devices?

MAC Address

segment cont

h, and checks

king the plus (2110. The soueserved. The isten on port

n this examples in this queryentries are hi

n the first lineesses of

ce MAC addreon MAC addrecal network.

at the source 68.1.1. In thisateway in this

?

s

tains the DNS

sum. Each fie

(+) sign. Noticurce port wasdestination p53 for DNS q

Page 3 of 6

e, y are ghlighted

e. This is

ess is ess is

IP s s network.

S query

eld in UDP

ce that s port is 53. queries

L

©

S

Lab - Using W

© 2013 Cisco and

In thisThe ofollow

The c

The Uhandslayer.

Recor

Is the

Is the

Step 3: Ex

In this ste

Wireshark to

d/or its affiliates.

s example, theother 32 byteswing illustratio

checksum is u

UDP header hshake in TCP

rd your Wires

Frame Size

Source MA

Destination

Source IP

Destination

Source Po

Destination

source IP ad

destination I

amine UDP

ep, you will ex

Examine a U

All rights reserve

e length of ths are used by n in the packe

used to determ

has low overhP. Any data tra

shark results i

e

AC address

n MAC addre

address

n IP address

rt

n Port

ddress the sam

P address the

P using DNS

xamine the DN

UDP DNS Ca

ed. This docume

is UDP segmDNS query d

et bytes pane

mine the integ

ead becauseansfer reliabil

n the table be

ess

s

me as the loc

e same as the

S response.

NS response

apture

ent is Cisco Publi

ment is 40 bytedata. The 32 be (lower sectio

grity of the pa

e UDP does nity issues tha

elow:

cal PC’s IP ad

e default gate

packet and v

ic.

es. Out of 40 bytes of DNSon) of the Wir

acket after it h

ot have fieldsat occur must

ddress record

eway noted in

verify that DNS

bytes, 8 byteS query data isreshark main

has traversed

s that are assbe handled b

ded in Part 1?

n Part 1?

S response p

es are used ass highlighted window.

the Internet.

sociated with tby the applica

packet also us

Page 4 of 6

s header. in the

three-way ation

ses UDP.

L

©

Lab - Using W

© 2013 Cisco and

a. In thiswire is

b. In thedevice

c. NoticeWhat

Destin

What

d. In the52110sent t

The srespo

WhenAnsw

Wireshark to

d/or its affiliates.

s example, fras 290 bytes. I

e Ethernet II fre is the destin

e the source ais the source

nation IP add

happened to

e UDP segme0. Port numbeto the DNS se

source port nuonse with a so

n the DNS reswers section.

Examine a U

All rights reserve

ame 5 is the cIt is a larger p

rame for the Dnation MAC a

and destinatioe IP address?

ress:

the roles of s

nt, the role ofer 52110 is therver. Your loc

umber is 53. Tource port num

sponse is exp

UDP DNS Ca

ed. This docume

correspondingpacket as com

DNS responseaddress?

on IP address

source and de

f the port numhe same port tcal PC listens

The DNS servmber of 53 ba

panded, notice

apture

ent is Cisco Publi

g DNS responmpared to the

e, from what

ses in the IP p

S

estination for

mbers has alsothat was genes for a DNS re

ver listens forack to originat

e the resolved

ic.

nse packet. NDNS query p

device is the

packet. What

Source IP ad

the local hos

o reversed. Terated by theesponse on th

r a DNS querytor of the DNS

d IP addresse

Notice the numpacket.

source MAC

t is the destina

dress:

st and default

The destinatioe local PC whehis port.

y on port 53 aS query.

es for www.go

mber of bytes

address and

ation IP addre

gateway?

on port numbeen the DNS q

and then send

oogle.com in

Page 5 of 6

s on the

what

ess?

er is query was

ds a DNS

the

L

©

R

Lab - Using W

© 2013 Cisco and

Reflection

What are

Wireshark to

d/or its affiliates.

the benefits o

Examine a U

All rights reserve

of using UDP

UDP DNS Ca

ed. This docume

instead of TC

apture

ent is Cisco Publi

CP as a trans

ic.

sport protocol for DNS?

Page 6 of 6