Does the destination IP address of the SYN packet correspond to any of the IP addresses provided in the DNS response message? Consider the subsequent TCP SYN packet sent by your host. Although it also provided 6 authoritative nameservers, and 11 other responses containing additional information.ĩ. The response message contained one answer to the query which was the sites address.How many “answers” are provided? What do each of these answers contain? The query message was a type “A” query, but the message did not contain any “answers.”Ĩ.What “Type” of DNS query is it? Does the query message contain any “answers”? Yes it is the same IP address as that of my local DNS server.ħ. The DNS query was sent to IP address 10.40.4.44.To what IP address is the DNS query message sent? Use ipconfig to determine the IP address of your local DNS server. What is the destination port for the DNS query message? What is the source port of DNS response message?Ħ. The DNS query and response messages are sent over UDP.ĥ.Locate the DNS query and response messages. Step 5: With your browser, visit the Web page: Ĥ. Step 4: Start packet capture in Wireshark. This filter removes all packets that neither originate nor are destined to your host. Step 3: Open Wireshark and enter “ip.addr = your_IP_address” into the filter, where you obtain your_IP_address with ipconfig. (With Internet Explorer, go to Tools menu and select Internet Options then in the General tab select Delete Files.) Step 2: Open your browser and empty your browser cache. Step 1: Use ipconfig to empty the DNS cache in your host. It then asks that we display our recent cached memory by using the command ipconfig /displaydnsįinally, we are told to clear the above cache by entering IPconfig /flushdns

This will display my machines current TCP/IP information, including my IP address, DNS server address and other additional information. All it requires is that we run IPconfig /all on our current machine. There are no questions for part two of this lab. The IP addreess for the DNS server if queried for the Yahoo! mail server is 209.191.122.42.Run nslookup so that one of the DNS servers obtained in Question 2 is queried for the mail servers for Yahoo! mail.

For this question, I used the webpage for Cambridge University in England.

Run nslookup to determine the authoritative DNS servers for a university in Europe. The IP address of that server was 203.159.12.3.Ģ.

For this question, I queried the webpage for the Asian Institute of Technology in Thialand.

Run nslookup to obtain the IP address of a Web server in Asia.

Wireshark display filter ipconfig