What is DNS or domain name system? In this video
I'm going to explain it in a lot of detail.
But before we get there, Alexa nslook up
Amazon.com, the DNS lookup for Amazon.com is 176.32.
103.205.
That is an example of what DNS does.
It's essentially resolving a name, typically a domain name to an IP address.
They lost.
nslookup google.com
the DNS lookup of google.com is 172.217.
164.142.
We as humans don't communicate easily using IP addresses.
We use domain names.
So if I told you to go to Google's IP address, you probably don't even remember what the IP address
was, but you'll remember what Google.com is.
So DNS essentially resolves a human readable name such as Google.com or Amazon.com to a machine
readable IP address.
Machines don't use names
they use IP addresses.
In IPv4, we use dotted decimal notation IP addresses such as 192.168.
1.1 IPv6 uses IP addresses such as 2001::123.
There are many IP addresses out there and many websites.
It's much easier to remember a domain name once again, like Facebook.com or Amazon.com rather
than the IP address of a server
and to further complicate it, like in my example, depending where you are on the world, a domain
name may resolve to a different IP address for load balancing.
So if I'm in the UK and I ping Google.com, I may get a different result to you
if you're in the US or in Singapore or somewhere else in the world. It's much easier to remember the domain
name than it is to remember an IP address
but machines use IP addresses and traffic is routed across the Internet using IP addresses, not names.
DNS is a fundamental building block in networks today without DNS, Internet wouldn't really work very
well because very few of us are gonna remember IP addresses.
Now, as an analogy, DNS is like a telephone book, taking a name, converting it to a telephone number,
but in this case, taking a domain name and converting it to an IP address and the bad old days, I'd
have to look up someone's number in a book and then I'd have to manually dial their telephone number
but I don't think any of us do that these days.
On a phone like an iPhone today, we're not gonna manually type a number like this and then dial
it.
We're going to go to our contacts and search for a contact and then just press on the contact to call
the person.
I mean, a lot of us probably don't even know our own telephone numbers these days.
We don't know the telephone numbers of other people because we simply look them up in a directory on
our phone.
Now, this is a local directory.
We can do something very similar on a PC by using what's called a hosts file.
That is the most basic version of so-called DNS.
Now, it's not DNS, but it's a local lookup.
So you could create your own version of DNS locally on your PC by editing the hosts file.
Taking that a step further, companies may have a local DNS server that resolves names within the organization
but on the public Internet, we have distributed DNS systems that allow us to resolve names such as
Google, Facebook, etc..
Now it's all very good and well talking about DNS, but I want to show you practically how it works.
I'm gonna show you wireshark captures.
I'm gonna show you how to set up a DNS server on a Cisco router, how to set it up on a Ubuntu
server.
I'll show you basically how you can manipulate a DNS to do anything that you want.
You need to be careful that you use trusted DNS servers.
Don't just trust any DNS server out there.
DNS can be intercepted and you can manipulate the DNS servers used by PCs to get them to go to the incorrect
domain.
Fortunately, today a lot of browsers like Chrome have a whole list of certificates preloaded on them.
So you'll get a warning if you end up going to an incorrect domain such as Microsoft.com or
Cisco.com.
OK, so in this topology I've got a Windows 10 computer it's connected to a Cisco switch which
in turn is connected to Cisco router, which connects us to the Internet.
This topology is running in GNS3,
I'm hosting this entire topology on my computer.
So forgive me if the fan goes a bit crazy.
It's all running locally on my Mac.
I also have an Ubuntu PC, which will configure as a DNS server.
OK, firstly, let's have a look at the Windows computer.
Here's my Windows PC.
I'll open up a CMD prompt.
Make this a bit bigger.
IP config shows me that this is the IP address of the PC IPv4 default gateways 10.1.1.
254
and I should at this point be able to ping my default gateway, which I can. Default
Gateway is the Cisco router with IP address once again 10.1.1.254.
The switch is a layer 2 switch
it's not really doing anything except giving connectivity in the network.
So back on the PC, IP config /all shows us that this PC has two DNS servers configured 8.8.8.
8 and 1.1.1.1.
In other words, Google and Cloudflare are the two DNS servers configured on the PC.
So I'll start a Wireshark capture between the PC and the switch so that we can see what's actually going
on.
Windows sends a lot of traffic into the network.
So as you can see here, a bunch of traffic is being sent by that Windows computer out into the network
but I'm going to filter for DNS and then back on the PC.
What I'll do is ping a domain such as DavidBombal.com and notice we get a reply from the IP address
217.160.0.69.
Now the CPU spiking on my PC here, the throughput through a Cisco switch and a Cisco router running
in GNS3 may be a bit slow
but the point is, is that I am getting replies back to that domain
and if we have a look at the Wireshark capture, what you'll notice is we can see that this IP address,
10 .1.1.1 sent a DNS request to 8.8.8.8 for domain DavidBombal.com.
So just to confirm on the PC, once again, IP config shows us that this is the IP address of the PC.
The PC send a request to the DNS server.
Notice the query is for DavidBombal.com.
It's a A record, A record is a domain name in IPv4, quadruple A is a domain name in IPv
6.
So the PC is asking the DNS server what the IP address is of the domain name.
Now, going back a step at layer 2 in the OSI model or TCPIP model, if you prefer, we have Ethernet
2, that's because this network is using Ethernet.
So it's an Ethernet connection
from the Windows PC to the Ethernet switch.
The source Mac address is the PC destination
Mac address is the router.
Basically, the traffic is being switched from the PC to the router because that's how it gets onto
the Internet.
So at layer 2 source Mac address will be the PC destination
Mac address will be the router, but at layer 3
IPv4 source IP address is the PC destination IP address is Google.
Now, you may notice that this is a RFC 1918 address.
In other words, it's a private IP address.
It's non-routable on the Internet, but the router is implementing network address translation or NAT.
This is very typical of what your route at home will be doing.
So notice it's NATTING this IP address now.
It is NATTING it to another RFC 1918 address, but that's because this route is connected to a cloud
which is actually bridging my PC physically.
So this PC here onto my physical home network and I have an Internet router that routes this onto the
Internet.
So it's actually being nattered multiple times.
But what's important to point out here is notice the protocol at layer 4 is UDP or user datagram
protocol. Source port number used is 52749
that is what's called an ephemeral or random port
number, destination port number is 53, which is the well-known port number for DNS.
When a server is configured to host multiple services, it's got to serve a purpose.
So it's a server that's acting as, let's say, a file server
when you connect to that server, it's going to give you a file
but when you connect to it using DNS, it's listening on Port 53 if it's been configured as a DNS server.
So you send traffic to Port 53, the server is listening on Port 53 it's running an application like which
I'll show you in a moment, DNS mask, which is a DNS server application, and then it responds back to that
request on the port number that you chose.
So if you connect to a DNS server like this PC is doing, you will use a random port number or ephemeral
port number going to a well-known port number, and then it'll reply back from that well-known port
number
and we can see that here.
Google is replying from a source port number 53, going to the port number that the PC chose.
The Windows 10 PC chose this port
number, the Google DNS server replies back to that port
number.
So, again, it's UDP destination port number is this, source port number is this digging deeper into
the DNS information we can see domain name system.
It's a query, it's a standard query for a name.
We're trying to resolve a name.
The name that we're resolving is DavidBombal.com
and the DNS server replies back saying, this is the answer.
This domain name has this IP address, 217.160.0.69.
So back on our Windows PC, that is the IP address that we see.
So I could copy that IP address, go to a Web browser.
If I type the domain name, it's going to browse to that server.
So I'm able to connect to the domain using the domain name
and this depends on the server.
I should be able to connect to the IP address of the server.
In this example, I'm getting a 404 error.
Now, some servers will not allow you to connect directly on the IP address.
That's typically because multiple domains are hosted on a single IP address.
OK, I'll stop the Wireshark capture, and what I want to show you once again is that DNS is essentially
just a resolution of name to IP address, and you can do that directly on your Windows computer.
So in windows, I'll open up notepad, I'll run this as an administrator.
Before I open a file, if I ping router 1
notice we're told that that domain name is not found.
The same with router 1 home.com, the ping request times out, I can't ping that domain name,
but what I could do is open a file
And what I'm going to do is go to see Windows System 32 Driver's ETSI and I'm going to open the hosts
file.
This is a file on the local Windows computer.
Just zoom in there to make it easier to read.
And I can edit this so I could say 10.1.1.254 is router 1 and 10.1.1.1.2
54 was router 1 home.com and save that file.
So I'm editing a local file that maps hostname to IP addresses.
So now when I ping router 1 notice that works.
When I ping r1.home.com, that also works, but if I ping router 2, that fails
because it's not in the host's file and Google is not replying back with that information.
So if I said r2 like this and save that file now, ping r2 that resolves.
Name got resolved to an IP address now in this example, the networks a bit unstable, so the pings
are timing out.
They had succeeded
but the important part is the domain name got resolved.
That name got resolved to an IP address.
If I remove these entries from the hosts file and save it.
I'll clear the screen there when I ping r1 now that's going to time out because
I don't have an entry for that domain name.
That's essentially what a DNS server does.
It takes a domain name and maps it to an IP address.