DNS Query Structure

Question

When I am sending a DNS query to the DNS it returns the header with the format bit set. Indicating there is a problem with the format, but I am failing to see what it is. Its possible I have misinterpreted the RFC, or misread it but right now I cant seem to work it out.

The DNS structure I am sending looks like this in hex.

Header

00 01   - ID = 1
01 00   - RD = 1
00 01   - QD = 1
00 00   - AN
00 00   - NS
00 00   - NR


   Question  for www.google.com

   03 77   - 3 w
   77 77   - w w
   06 67   - 6 g
   6f 6f   - o o
   67 6c   - g l
   65 03   - e 3
   63 6f   - c o
   6d 00   - m 0
   00 01   - QTYPE
   00 01   - QCLASS

I then flip the bytes for any field that is two bytes, to convert to big endian for the network format. So each row of the header, and then QTYPE and QCLASS ...

Answer 1

I tend to think that your problem depends on how are you actually "flipping the bits to convert to network format".

Typical C library implementations provide the htonl() function family to do the conversion from host into network order and viceversa.

Of course, without seeing the code, I cannot be sure that this is the problem.

Answer 2

Here's what a byte-by-byte hexdump of that query packet should look like (tested and working!):

00000000  00 01 01 00 00 01 00 00  00 00 00 00 03 77 77 77  |.............www|
00000010  06 67 6f 6f 67 6c 65 03  63 6f 6d 00 00 01 00 01  |.google.com.....|

I think your problem is that the third and fourth bytes of the packet (flags and rcode) are two single-byte fields, not one 2-byte field - it looks like you might be treating it as a 16 bit integer and swapping the bytes?