Reading DNS traffic in depth
You trace DNS message structure, record types, recursion and encrypted DNS in traffic and recognise abuse patterns.
Level 201 · 16 lessons · 15 practice labs
Lessons
The DNS message
- DNS message format: header, question, answer, authority, additional
- Record types: A, AAAA, CNAME, MX, TXT, NS, PTR, SRV
- The recursion path: client, resolver, root, TLD, authoritative
- Response codes: NOERROR, NXDOMAIN, SERVFAIL, REFUSED
- Short task: draw the resolution path of a domain from packets
Transport and security
- DNS over TCP and zone transfers (AXFR)
- DNSSEC records on the wire: RRSIG, DNSKEY, DS
- DNS over HTTPS and DNS over TLS: what you can and cannot see
- Short task: detect an open zone transfer on the lab server
Spotting abuse
- Algorithmically generated domains (DGA) and NXDOMAIN storms
- DNS tunnelling: long subdomains and TXT payloads
- Fast-flux answers and short TTLs
- Building a normal DNS profile: top queries and frequency
- Blocking and watching malicious domains with a DNS sinkhole
- Short task: write three measures that separate tunnel traffic from normal queries
- Capstone: report the suspicious items in a company network’s DNS capture
Practice labs
- Mark the sections of a DNS message: Show the header, question, answer, authority and additional sections of a query and response pair with their record counts.
- Record type inventory: Count A, AAAA, CNAME, MX, TXT, PTR and SRV queries in an hour of DNS capture and give an example of the rarest type.
- Follow a CNAME chain to the end: List every answer and TTL in a four-link CNAME chain until the final address is reached.
- Count the response codes: Count the DNS responses in a capture as NOERROR, NXDOMAIN, SERVFAIL and REFUSED.
- Draw the resolution path with packets: In a capture taken at the resolver, show the queries to the root, TLD and authoritative server in order.
- Where the SERVFAIL comes from: Show with packets which server's fault causes the SERVFAIL returned for one of Saklıvadi Üniversitesi's domain names.
- Find DNS going over TCP: Filter the DNS exchanges using TCP 53 in a capture and state why they moved from UDP to TCP.
- Detect an open zone transfer: Report the AXFR request, the requesting address and the number of records transferred in your own lab DNS server's capture.
- Order DNSSEC records into a validation chain: Find the RRSIG, DNSKEY and DS records in a response and show the difference between a signed and an unsigned answer.
- List overly long subdomains: Sort the query names in a capture by length and list the subdomains longer than 50 characters.
- The source of an NXDOMAIN storm: Find the internal host querying random-looking domains from its NXDOMAIN ratio and attach sample names.
- Three measures separating a tunnel from normal queries: Separate the tunnel traffic in a prepared capture by query length, TXT ratio and unique subdomain count and write the thresholds.
- The twenty most queried domains: Extract the twenty most queried domains and their query counts from a day of DNS capture.
- Short TTLs and fast-changing answers: List the domains whose answers keep changing and whose TTL stays below 300 seconds.
- Build a sinkhole and watch the hits: Sinkhole three domains on the lab resolver and report from the log which clients asked for them.
About this course
You trace DNS message structure, record types, recursion and encrypted DNS in traffic and recognise abuse patterns.
What you will learn
- The DNS message
- Transport and security
- Spotting abuse
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.