0

In the RFC 1035 about DNS, it's written :

4.2.2. TCP usage

Messages sent over TCP connections use server port 53 (decimal). The message is prefixed with a two byte length field which gives the message length, excluding the two byte length field. This length field allows the low-level processing to assemble a complete message before beginning to parse it.

I want to send a DNS request with TCP but I don't know how to add these two bytes before the DNS request. I try with that code : 

from scapy.all import *

ip=IP(dst="216.239.32.10")

request = DNS(rd=1, qd=DNSQR(qname = "google.be", qtype="A")) #size = 27(dec) = 1b (hex)
twoBytesRequestSize = "\x1b\x00" 
completeRequest = str(request) + twoBytesRequestSize

SYN=ip/TCP(sport=RandNum(1024,65535), dport=53, flags="S", seq=42)
SYNACK=sr1(SYN)

ACK=ip/TCP(sport=SYNACK.dport, dport=53, flags="A", seq=SYNACK.ack, ack=SYNACK.seq + 1)
send(ACK)

DNSRequest = ip/TCP(sport=SYNACK.dport, dport=53, flags="PA", seq=SYNACK.ack, ack=SYNACK.seq + 1) / completeRequest
DNSReply = sr1(DNSRequest, timeout = 1)

But my paquet is interpreted like a simple TCP packet without DNS layer.

Have you an idea to add these two bytes prefix before the DNS request?

Thank you !

Shog9
  • 156,901
  • 35
  • 231
  • 235
Comtention
  • 123
  • 3
  • 9
  • What are you actually trying to accomplish? Just look up a DNS A record? If so, there are easier ways. – John Zwinck Mar 26 '13 at 13:58
  • Unsure if it will help, but internet protocols are generally big endian, which means you need `\x00\x1b` instead of `\x1b\x00`. – Armin Rigo Mar 26 '13 at 14:04
  • John, I need to retrieve the timestamp of the DNS server, and I can't get it in the SYNACK response because some implementation of SYNCOOKIES use the timestamp option. Armin, It works, your are the man of this day ! I was pretty sure that I have tried with big endiant. Thanks. – Comtention Mar 26 '13 at 14:49
  • @Comtention you can get the server's time by sending it a (UDP) query with an invalid TSIG key in it ;-) – Alnitak Mar 26 '13 at 16:55

1 Answers1

0

The solution uses Big endian notation. \x00\x1b instead of \x1b\x00. But the rest of the code above is correct. Thank you Armin.

Comtention
  • 123
  • 3
  • 9