Introduction
The project code can be found at https://github.com/melonskin/simple-dns-lookup.
This is a naive implementation of DNS resolver. The function is basically the same as nslookup
. It takes two arguments. The first is the lookup string. It can be either a host or a IP address. The second is the DNS server you would like to query. For example:
dns-resolver.exe www.dhs.gov 128.194.135.84
dns-resolver.exe 206.190.39.42 8.8.8.8
The result is shown as below.
PS ...> .\dns-resolver.exe www.dhs.gov 128.194.135.84
Lookup : www.dhs.gov
Query : www.dhs.gov, type 1 TXID 0x567A
Server : 128.194.135.84
*******************************************
Attempt 0 with 29 bytes... response in 29 ms with 442 bytes
TXID 0x567A flags 0x8180 questions 1 answers 3 authority 8 additional 9
succeeded with Rcode = 0
------------- [questions] -----------
www.dhs.gov type 1 class 1
------------- [answers] -----------
www.dhs.gov CNAME www.dhs.gov.edgekey.net TTL = 1625
www.dhs.gov.edgekey.net CNAME e6485.dsca.akamaiedge.net TTL = 174
e6485.dsca.akamaiedge.net A 23.35.235.8 TTL = 20
------------- [authority] -----------
dsca.akamaiedge.net NS n2dsca.akamaiedge.net TTL = 2025
dsca.akamaiedge.net NS n0dsca.akamaiedge.net TTL = 2025
dsca.akamaiedge.net NS n1dsca.akamaiedge.net TTL = 2025
dsca.akamaiedge.net NS n6dsca.akamaiedge.net TTL = 2025
dsca.akamaiedge.net NS n4dsca.akamaiedge.net TTL = 2025
dsca.akamaiedge.net NS n7dsca.akamaiedge.net TTL = 2025
dsca.akamaiedge.net NS n5dsca.akamaiedge.net TTL = 2025
dsca.akamaiedge.net NS n3dsca.akamaiedge.net TTL = 2025
------------- [additional] -----------
n0dsca.akamaiedge.net A 88.221.81.192 TTL = 2025
n1dsca.akamaiedge.net A 66.171.227.43 TTL = 2025
n2dsca.akamaiedge.net A 66.171.227.44 TTL = 2025
n3dsca.akamaiedge.net A 66.171.227.45 TTL = 2025
n4dsca.akamaiedge.net A 66.171.227.242 TTL = 2025
n5dsca.akamaiedge.net A 66.171.227.246 TTL = 2025
n6dsca.akamaiedge.net A 69.31.59.75 TTL = 2025
n7dsca.akamaiedge.net A 128.177.98.250 TTL = 2025
PS ...> .\dns-resolver.exe 206.190.39.42 8.8.8.8
Lookup : 206.190.39.42
Query : 42.39.190.206.in-addr.arpa, type 12 TXID 0x35DB
Server : 8.8.8.8
*******************************************
Attempt 0 with 44 bytes... response in 16 ms with 103 bytes
TXID 0x35DB flags 0x8180 questions 1 answers 1 authority 0 additional 0
succeeded with Rcode = 0
------------- [questions] -----------
42.39.190.206.in-addr.arpa type 12 class 1
------------- [answers] -----------
42.39.190.206.in-addr.arpa PTR media-router-fp1.prod.media.vip.gq1.yahoo.com TTL = 454
Implementation
The program takes the lookup string and identify whether it’s a type A
or PTR
. A query packet is assembled and sent to the server via UDP. Response are checked for safety purpose and parsed into human-readable format.
Multiple error response cases can be recognized and reported, such as:
- invalid reply: smaller than fixed header
- invalid section: not enough records
- invalid record: jump beyond packet boundary
- invalid record: truncated name
- invalid record: truncated fixed RR header
- invalid record: truncated jump offset
- invalid record: jump into fixed header
- invalid record: jump loop
- invalid record: RR value length beyond packet
- invalid reply: TXID mismatch