0

At what point in a request process does the DNS come into play? Is the logic flow below correct? If so, where in that process is a DNS server called to translate google.com to 216.68.248.42? (Or am I completely misunderstanding and each router has a list of domain_name/IP key value pairs or something)

  1. Computer issues packets with "google.com" address.
  2. Packets travel to local router and are forwarded to ISP.
  3. Packets forwarded via ISP routers to ISP network (HOW? It doesn't seem like there is an IP yet, just 'google.com').
  4. Packets move around ISP's network and possibly move to another IPS.
  5. Packets arrive at destination.
  6. Response packets sent back to issuer IP address.

Nowhere in these steps do I see "DNS server asked for IP address of 'google.com'" (what asks this question/makes the call?). Furthermore, if I tracert to google.com, nowhere do I see a DNS being hit.

So then, at what step does `google.com' become 216.68.248.42?

Improve this question
5
  • 1
    For future reference – consider installing Wireshark, which lets you see what is really sent in the packets, down to the individual fields (unlike e.g. tcpdump).
    – u1686_grawity
    Dec 20, 2016 at 17:06
  • Will do, thanks. Saw a whole book on it recently, but was reluctant to dive into it fully.
    – VSO
    Dec 20, 2016 at 17:24
  • 1
    Don't need a book on it – start the app, hit "Capture", watch the packets flow. Although a cheatsheet on Wireshark display filters would come handy (e.g. for showing only DNS packets).
    – u1686_grawity
    Dec 20, 2016 at 17:29
  • 1
    ISP (Internet Service Provider), not IPS.
    – deltab
    Dec 20, 2016 at 22:52
  • @deltab yea, yea
    – VSO
    Dec 21, 2016 at 1:02

3 Answers 3

Reset to default
7

DNS works very much like a phonebook – you look up the number before calling; likewise, the OS looks up addresses for google.com before sending any packets, and the moment an IP packet is "issued" and reaches the first router, it already has raw IP addresses in its header.

That way routers do not have to deal with domain names at all – routing remains completely separate from "domain names", and one can be improved or replaced without affecting the other.

DNS queries themselves are also regular IP packets (UDP port 53, specifically) and are subject to the same IP routing. The whole process looks somewhat like the following:

  1. Program wants to connect to www.google.com:80 via TCP.
  2. Program asks the OS's DNS library to resolve www.google.com to a list of IP addresses.
  3. DNS library uses OS functions to send a UDP "DNS query" packet to the preconfigured DNS server.
  4. The DNS query packet is routed as in your steps 2–6.
  5. DNS library receives a response packet.
  6. Program receives a list of IP addresses.
  7. Program uses OS functions to establish a TCP connection to one of the received addresses.
  8. The TCP packets are, also, routed as in your steps 2–6.

As to how the initial DNS server address (for use in step 3) is obtained:

  • Your OS's built-in "stub" resolver only uses one server (e.g. your ISP's, or a public one like Google's "8.8.8.8") and has it perform all the work – this server address can be configured by hand, or received via DHCP from the router. On Windows, the same "IP configuration" screen has a field for the DNS servers. On Linux, it's /etc/resolv.conf.

  • Your ISP's "recursive" resolvers perform the full lookup process themselves, so they start with the built-in list of the Internet's root name servers and chase the delegations (root → com → google.com).

Improve this answer
2
  • Please see comment on Rebel's answer.
    – VSO
    Dec 20, 2016 at 16:48
  • 2
    @VSO: Half of it is already answered. DNS cannot possibly show up in traceroute because the DNS lookup has no part in routing at all. (DNS query packets themselves are regular IP/UDP packets and are routed as such.)
    – u1686_grawity
    Dec 20, 2016 at 16:51
3

Before the step 1 - human-readable address gets translated into IP by either DNS lookup on a remote DNS (by recursively asking predefined set of DNS servers and asking "who is responsible for the google.com") or by querying local cache. Then the packets get sent to IP with several markings (depending on what exactly do you want from google.com)

Improve this answer
2
  • I don't understand this answer. Let's ignore the cache for now. First of all, when you say "predefined", predefined where, in the OS? Second of all, how is this call made; all logic points to it being made through your modem (...because there is no other way). So, if it goes through your modem, it goes to the local neighborhood router provided by your ISP. Then to the ISP. So, is a call to a DNS basically just a call to some server just like a normal call to some server? Is this call shown anywhere in the browser console? Is it shown on tracert?
    – VSO
    Dec 20, 2016 at 16:47
  • @VSO You should probably add this to your original question.
    – Hydraxan14
    Dec 20, 2016 at 16:56
3

The Domain Name System (DNS) is a distributed system for converting human-readable domain names (e.g. example.com) to IP addresses (e.g. 192.0.2.1) that can be used to connect to actual servers. It is, in essence, the phone book of the Internet and is a vital component of the Internet's infrastructure.

The Internet contains a large number of DNS servers. Most people use servers provided by their ISP, although one can easily configure their systems and home networks to use an alternative DNS service such as Google Public DNS (8.8.8.8 and 8.8.4.4). With appropriate server software, one can also host their own DNS server.

When you go to a particular website, your browser (typically via your device's operating system) will query a DNS server to get the IP address the domain corresponds to, then connect to the server using that IP address. If the domain name isn't registered, a properly-designed DNS server should return NXDOMAIN (nonexistent domain), though many ISP-run DNS servers return an ad-sponsored search page instead by default. Most systems cache DNS lookup results so that they don't need to repeatedly query the server for the same website's address.

Because DNS is vital to accessing websites on the Internet, attackers have been attempting to disable the system via DDoS attacks. As an example of how important DNS is, a terabit-scale DDOS attack on major DNS provider Dyn on October 21, 2016 rendered a large number of major websites, ranging from Amazon to Yelp, inaccessible for a substantial portion of the United States population.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .