By default DNS server will serve all client queries with UDP protocol on 53 port. One reason for this selection of protocol is to get faster answers from DNS Server to the client. The UDP protocol do not require any handshake like TCP before the connection establishment.
Many people new to Linux do not know that we can change the protocol when querying using DNS tools. There is way we can force our DNS queries to use TCP connection instead of UDP connection. Let us see how to force DNS clients like nslookup, dig to use TCP protocol rather than UDP protocol.
Using nslookup:
Example1: Query linuxnix.com after setting vc option
Example
[root@localhost fd]# nslookup
> set vc
> linuxnix.com
Server: 192.168.40.2
Address: 192.168.40.2#53 Non-authoritative answer:
Name: linuxnix.com
Address: 141.101.117.13
Name: linuxnix.com
Address: 141.101.116.13
> exit [root@localhost fd]#
Corsponding TCPDUMP output:
[root@localhost surendra]# tcpdump -i eth0 tcp port 53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:20:56.949852 IP 192.168.40.128.48213 > 192.168.40.2.domain: Flags [S], seq 1153779393, win 5840, options [mss 1460,sackOK,TS val 68892286 ecr 0,nop,wscale 6], length 0
09:20:57.009898 IP 192.168.40.2.domain > 192.168.40.128.48213: Flags [S.], seq 161618490, ack 1153779394, win 64240, options [mss 1460], length 0
09:20:57.009953 IP 192.168.40.128.48213 > 192.168.40.2.domain: Flags [.], ack 1, win 5840, length 0
09:20:57.012126 IP 192.168.40.128.48213 > 192.168.40.2.domain: Flags [P.], seq 1:33, ack 1, win 5840, length 3238272+ A? linuxnix.com. (30)
09:20:57.012435 IP 192.168.40.2.domain > 192.168.40.128.48213: Flags [.], ack 33, win 64240, length 0
09:20:57.015475 IP 192.168.40.2.domain > 192.168.40.128.48213: Flags [P.], seq 1:65, ack 33, win 64240, length 6438272 2/0/0 A 141.101.117.13, A 141.101.116.13 (62)
09:20:57.015522 IP 192.168.40.128.48213 > 192.168.40.2.domain: Flags [.], ack 65, win 5840, length 0
09:20:57.016674 IP 192.168.40.128.48213 > 192.168.40.2.domain: Flags [F.], seq 33, ack 65, win 5840, length 0
09:20:57.017209 IP 192.168.40.2.domain > 192.168.40.128.48213: Flags [.], ack 34, win 64239, length 0
09:20:57.020220 IP 192.168.40.2.domain > 192.168.40.128.48213: Flags [FP.], seq 65, ack 34, win 64239, length 0
09:20:57.020269 IP 192.168.40.128.48213 > 192.168.40.2.domain: Flags [.], ack 66, win 5840, length 0
Example2: Forcing dig to use tcp connection by using +tcp option as shown below.
[root@localhost fd]# dig +tcp linuxnix.com ; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> +tcp linuxnix.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16760
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION:
;linuxnix.com. IN A ;; ANSWER SECTION:
linuxnix.com. 143 IN A 141.101.116.13
linuxnix.com. 143 IN A 141.101.117.13 ;; Query time: 7 msec
;; SERVER: 192.168.40.2#53(192.168.40.2)
;; WHEN: Tue Nov 26 09:21:50 2013
;; MSG SIZE rcvd: 62
Corsponding TCPDUMP output:
09:21:50.294476 IP 192.168.40.128.43512 > 192.168.40.2.domain: Flags [S], seq 1984885075, win 5840, options [mss 1460,sackOK,TS val 68945630 ecr 0,nop,wscale 6], length 0
09:21:50.298193 IP 192.168.40.2.domain > 192.168.40.128.43512: Flags [S.], seq 364468889, ack 1984885076, win 64240, options [mss 1460], length 0
09:21:50.298273 IP 192.168.40.128.43512 > 192.168.40.2.domain: Flags [.], ack 1, win 5840, length 0
09:21:50.298677 IP 192.168.40.128.43512 > 192.168.40.2.domain: Flags [P.], seq 1:33, ack 1, win 5840, length 3216760+ A? linuxnix.com. (30)
09:21:50.299053 IP 192.168.40.2.domain > 192.168.40.128.43512: Flags [.], ack 33, win 64240, length 0
09:21:50.302191 IP 192.168.40.2.domain > 192.168.40.128.43512: Flags [P.], seq 1:65, ack 33, win 64240, length 6416760 2/0/0 A 141.101.116.13, A 141.101.117.13 (62)
09:21:50.302339 IP 192.168.40.128.43512 > 192.168.40.2.domain: Flags [.], ack 65, win 5840, length 0
09:21:50.307300 IP 192.168.40.128.43512 > 192.168.40.2.domain: Flags [F.], seq 33, ack 65, win 5840, length 0
09:21:50.308262 IP 192.168.40.2.domain > 192.168.40.128.43512: Flags [.], ack 34, win 64239, length 0
09:21:50.310440 IP 192.168.40.2.domain > 192.168.40.128.43512: Flags [FP.], seq 65, ack 34, win 64239, length 0
09:21:50.310483 IP 192.168.40.128.43512 > 192.168.40.2.domain: Flags [.], ack 66, win 5840, length 0
Conclusion is we can force DNS server to respond to our TCP queries and one more point to note is that for zone transfers DNS uses TCP protocol.
The following two tabs change content below.
Mr Surendra Anne is from Vijayawada, Andhra Pradesh, India. He is a Linux/Open source supporter who believes in Hard work, A down to earth person, Likes to share knowledge with others, Loves dogs, Likes photography. He works as Devops Engineer with Taggle systems, an IOT automatic water metering company, Sydney . You can contact him at surendra (@) linuxnix dot com.
Latest posts by Surendra Anne (see all)
- Docker: How to copy files to/from docker container - June 30, 2020
- Anisble: ERROR! unexpected parameter type in action:
Fix - June 29, 2020 - FREE: JOIN OUR DEVOPS TELEGRAM GROUPS - August 2, 2019
- Review: Whizlabs Practice Tests for AWS Certified Solutions Architect Professional (CSAP) - August 27, 2018
- How to use ohai/chef-shell to get node attributes - July 19, 2018
