01实现基础DNS服务器

前言

  • 实现简单的访问外部网络功能，只实现基础的DNS转发功能 即DNS服务器去访问根服务器来获取URL对应的IP，当然此DNS服务器也具有缓存功能

CentOS

安装 bind DNS

  • 略

环境说明

hostname IP service
DNS 10.0.0.8 bind9

修改 bind DNS 配置文件

修改方式一

[root@DNS ~]# vim /etc/named.conf 
options {
...
    listen-on port 53 { localhost; };  #BIND DNS 不支持 0.0.0.0表示所有IP地址，但提供了 localhost 这个内置关键子来表示所有IP，避免了DNS IP发生变化而导致的问题
...
    allow-query     { any; }; #any表示允许所有人使用此DNS，也可以写成10.0.0.0/24，表示哪个网段访问

修改方式二

  • 将方式一的两行注释掉 可以达到和方式一 一样的效果
[root@DNS ~]# vim /etc/named.conf 
options {
//  listen-on port 53 { 127.0.0.1; };
...
//  allow-query     { localhost; };
...

启动 bind DNS

#检查配置文件语法是否有误，无报错即表示语法无误
[root@DNS ~]# named-checkconf

#启动bind DNS
[root@DNS ~]# systemctl enable --now named

#如果已经启动 bind DNS 可以用重新加载配置文件的方式来生效
[root@DNS ~]# rndc reload
server reload successful

测试访问

#测试机 DNS 指向 bind DNS
[root@18 ~]# cat /etc/resolv.conf 
# Generated by NetworkManager
nameserver 10.0.0.8

#测试访问
[root@18 ~]# ping -c1 www.baidu.com
PING www.a.shifen.com (39.156.66.18) 56(84) bytes of data.
64 bytes from 39.156.66.18 (39.156.66.18): icmp_seq=1 ttl=128 time=39.4 ms


#查看DNS详细信息，此工具需要安装 bind-utils 包
[root@18 ~]# dig www.baidu.com

; <<>> DiG 9.11.26-RedHat-9.11.26-6.el8 <<>> www.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9678
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 5, ADDITIONAL: 6

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 4f2d39d5cfa505fdd141c1bb61bbf6e6c9d1e28dc580c153 (good)
;; QUESTION SECTION:
;www.baidu.com.			IN	A

;; ANSWER SECTION:
www.baidu.com.		907	IN	CNAME	www.a.shifen.com.
www.a.shifen.com.	9	IN	A	39.156.66.18
www.a.shifen.com.	9	IN	A	39.156.66.14

;; AUTHORITY SECTION:
a.shifen.com.		908	IN	NS	ns4.a.shifen.com.
a.shifen.com.		908	IN	NS	ns1.a.shifen.com.
a.shifen.com.		908	IN	NS	ns5.a.shifen.com.
a.shifen.com.		908	IN	NS	ns2.a.shifen.com.
a.shifen.com.		908	IN	NS	ns3.a.shifen.com.

;; ADDITIONAL SECTION:
ns4.a.shifen.com.	908	IN	A	14.215.177.229
ns1.a.shifen.com.	908	IN	A	110.242.68.42
ns2.a.shifen.com.	908	IN	A	220.181.33.32
ns5.a.shifen.com.	908	IN	A	180.76.76.95
ns3.a.shifen.com.	908	IN	A	112.80.255.253

;; Query time: 0 msec
;; SERVER: 10.0.0.8#53(10.0.0.8)   #DNS SERVER
;; WHEN: Fri Dec 17 18:33:09 CST 2021
;; MSG SIZE  rcvd: 299

Ubuntu

安装 bind DNS

  • 略

环境说明

hostname IP service
dns-server 10.0.0.103 bind9

修改 bind DNS 配置文件

root@dns-server:~# vim /etc/bind/named.conf.options
options {
	directory "/var/cache/bind";

	// If there is a firewall between you and nameservers you want
	// to talk to, you may need to fix the firewall to allow multiple
	// ports to talk.  See http://www.kb.cert.org/vuls/id/800113

	// If your ISP provided one or more IP addresses for stable 
	// nameservers, you probably want to use them as forwarders.  
	// Uncomment the following block, and insert the addresses replacing 
	// the all-0's placeholder.

	// forwarders {
	// 	0.0.0.0;
	// };

	//========================================================================
	// If BIND logs error messages about the root key being expired,
	// you will need to update your keys.  See https://www.isc.org/bind-keys
	//========================================================================
	dnssec-validation auto;

	listen-on-v6 { any; };
	#主要添加以下两行，以下两行所添加的内容和不添加起到一样的效果，但是添加后更便于管理，如修改allow-query可以实现允许指定的网段访问此 dns-server
    listen-on port 53 { localhost; };  #BIND DNS 不支持 0.0.0.0表示所有IP地址，但提供了 localhost 这个内置关键子来表示所有IP，避免了DNS IP发生变化而导致的问题
    allow-query     { any; }; #any表示允许所有人使用此DNS，也可以写成10.0.0.0/24，表示哪个网段访问
};

启动 bind DNS

#检查配置文件语法是否有误，无报错即表示语法无误
root@dns-server:~# named-checkconf

#启动bind DNS
root@dns-server:~# systemctl enable --now named

#如果已经启动 bind DNS 可以用重新加载配置文件的方式来生效
root@dns-server:~# rndc reload
server reload successful

测试访问

#测试机 DNS 指向 bind DNS
[root@client ~]# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.0.0.103


#测试访问
[root@client ~]# ping -c1 www.baidu.com
PING www.a.shifen.com (39.156.66.18) 56(84) bytes of data.
64 bytes from 39.156.66.18 (39.156.66.18): icmp_seq=1 ttl=128 time=39.4 ms

抓包详情

第一次递归查询

[root@client ~]# ping -c1 www.baidu.com
...


root@dns-server:~# tcpdump -nn -i eth0 -p udp port 53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes

13:55:49.188650 IP 10.0.0.201.48287 > 10.0.0.103.53: 30560+ A? www.baidu.com. (31)
13:55:49.188651 IP 10.0.0.201.48287 > 10.0.0.103.53: 17000+ AAAA? www.baidu.com. (31)
13:55:49.190212 IP 10.0.0.103.42460 > 192.36.148.17.53: 15295 [1au] A? _.com. (46)
13:55:49.204356 IP 192.36.148.17.53 > 10.0.0.103.42460: 15295-| 0/0/1 (62)
13:55:49.237893 IP 10.0.0.103.45329 > 192.55.83.30.53: 4614 [1au] A? _.baidu.com. (52)
13:55:50.033031 IP 10.0.0.103.43593 > 192.48.79.30.53: 53208 [1au] A? _.baidu.com. (52)
13:55:50.318281 IP 192.48.79.30.53 > 10.0.0.103.43593: 53208-| 0/8/2 (500)
13:55:50.903029 IP 10.0.0.103.60356 > 192.5.5.241.53: 18986% [1au] AAAA? ns2.baidu.com. (54)
13:55:50.903580 IP 10.0.0.103.53973 > 192.5.5.241.53: 28016% [1au] AAAA? ns3.baidu.com. (54)
13:55:50.903768 IP 10.0.0.103.60575 > 192.5.5.241.53: 54743% [1au] AAAA? ns4.baidu.com. (54)
13:55:50.905003 IP 10.0.0.103.56928 > 220.181.33.31.53: 31969 [1au] A? www.baidu.com. (54)
13:55:50.905754 IP 10.0.0.103.51524 > 220.181.33.31.53: 15714 [1au] AAAA? www.baidu.com. (54)
13:55:50.906277 IP 10.0.0.103.44491 > 192.5.5.241.53: 6173% [1au] AAAA? ns1.baidu.com. (54)
13:55:50.931898 IP 220.181.33.31.53 > 10.0.0.103.51524: 15714*- 1/0/1 CNAME www.a.shifen.com. (100)
13:55:50.933235 IP 10.0.0.103.34682 > 192.5.6.30.53: 3004 [1au] DS? baidu.com. (50)
13:55:50.937546 IP 220.181.33.31.53 > 10.0.0.103.56928: 31969*- 1/0/1 CNAME www.a.shifen.com. (100)
13:55:50.963119 IP 192.5.5.241.53 > 10.0.0.103.60575: 54743-| 0/0/1 (70)
13:55:50.963303 IP 192.5.5.241.53 > 10.0.0.103.60356: 18986-| 0/0/1 (70)
13:55:50.964550 IP 192.5.5.241.53 > 10.0.0.103.53973: 28016-| 0/0/1 (70)
13:55:50.980943 IP 192.5.5.241.53 > 10.0.0.103.44491: 6173-| 0/0/1 (70)
13:55:51.091720 IP 10.0.0.103.35854 > 192.5.6.30.53: 50414% [1au] AAAA? ns3.baidu.com. (54)
13:55:51.107569 IP 10.0.0.103.42219 > 192.5.6.30.53: 56652% [1au] AAAA? ns2.baidu.com. (54)
13:55:51.108739 IP 10.0.0.103.57578 > 192.5.6.30.53: 62867% [1au] AAAA? ns4.baidu.com. (54)
13:55:51.123836 IP 10.0.0.103.42918 > 192.5.6.30.53: 8029% [1au] AAAA? ns1.baidu.com. (54)
13:55:51.134272 IP 192.5.6.30.53 > 10.0.0.103.34682: 3004*-| 0/4/1 (465)
13:55:51.291901 IP 192.5.6.30.53 > 10.0.0.103.35854: 50414-| 0/8/2 (498)
13:55:51.309516 IP 192.5.6.30.53 > 10.0.0.103.57578: 62867-| 0/8/2 (498)
13:55:51.309516 IP 192.5.6.30.53 > 10.0.0.103.42219: 56652-| 0/8/2 (498)
13:55:51.324922 IP 192.5.6.30.53 > 10.0.0.103.42918: 8029-| 0/8/2 (498)
13:55:51.541271 IP 10.0.0.103.50299 > 192.43.172.30.53: 46317 [1au] DNSKEY? com. (44)
13:55:51.696584 IP 10.0.0.103.39241 > 112.80.248.64.53: 8235% [1au] AAAA? ns3.baidu.com. (54)
13:55:51.711748 IP 10.0.0.103.60378 > 112.80.248.64.53: 29278% [1au] AAAA? ns4.baidu.com. (54)
13:55:51.715616 IP 10.0.0.103.41438 > 112.80.248.64.53: 22620% [1au] AAAA? ns2.baidu.com. (54)
13:55:51.724785 IP 10.0.0.103.60401 > 112.80.248.64.53: 65008% [1au] AAAA? ns1.baidu.com. (54)
13:55:51.747583 IP 112.80.248.64.53 > 10.0.0.103.39241: 8235*- 0/1/1 (113)
13:55:51.756599 IP 192.43.172.30.53 > 10.0.0.103.50299: 46317*-| 2/0/1 DNSKEY, DNSKEY (486)
13:55:51.760245 IP 112.80.248.64.53 > 10.0.0.103.60378: 29278*- 0/1/1 (113)
13:55:51.771611 IP 112.80.248.64.53 > 10.0.0.103.60401: 65008*- 0/1/1 (113)
13:55:51.774317 IP 112.80.248.64.53 > 10.0.0.103.41438: 22620*- 0/1/1 (113)
13:55:52.192882 IP 10.0.0.103.51826 > 192.26.92.30.53: 32638 [1au] A? _.shifen.com. (53)
13:55:52.389703 IP 192.26.92.30.53 > 10.0.0.103.51826: 32638-| 0/7/2 (489)
13:55:52.790441 IP 10.0.0.103.40457 > 14.215.178.80.53: 46329 [1au] A? _.a.shifen.com. (55)
13:55:52.850753 IP 14.215.178.80.53 > 10.0.0.103.40457: 46329- 0/5/8 (297)
13:55:52.851940 IP 10.0.0.103.48320 > 199.9.14.201.53: 11835% [1au] AAAA? ns2.a.shifen.com. (57)
13:55:52.852652 IP 10.0.0.103.51493 > 199.9.14.201.53: 45087% [1au] AAAA? ns4.a.shifen.com. (57)
13:55:52.853212 IP 10.0.0.103.33541 > 14.215.177.229.53: 12398 [1au] A? www.a.shifen.com. (57)
13:55:52.853872 IP 10.0.0.103.48617 > 14.215.177.229.53: 22514 [1au] AAAA? www.a.shifen.com. (57)
13:55:52.854197 IP 10.0.0.103.37306 > 199.9.14.201.53: 21029% [1au] AAAA? ns1.a.shifen.com. (57)
13:55:52.854247 IP 10.0.0.103.38261 > 199.9.14.201.53: 11272% [1au] AAAA? ns3.a.shifen.com. (57)
13:55:52.920048 IP 14.215.177.229.53 > 10.0.0.103.48617: 22514*- 0/1/1 (139)
13:55:52.921197 IP 10.0.0.103.54172 > 192.52.178.30.53: 39310 [1au] DS? shifen.com. (51)
13:55:52.923155 IP 14.215.177.229.53 > 10.0.0.103.33541: 12398*- 2/0/1 A 39.156.66.14, A 39.156.66.18 (105)
13:55:53.192233 IP 192.52.178.30.53 > 10.0.0.103.54172: 39310*-| 0/4/1 (466)
13:55:53.648338 IP 10.0.0.103.39508 > 198.97.190.53.53: 16833% [1au] AAAA? ns2.a.shifen.com. (57)
13:55:53.648655 IP 10.0.0.103.56677 > 198.97.190.53.53: 394% [1au] AAAA? ns4.a.shifen.com. (57)
13:55:53.649193 IP 10.0.0.103.59192 > 198.97.190.53.53: 26688% [1au] AAAA? ns1.a.shifen.com. (57)
13:55:53.650391 IP 10.0.0.103.46140 > 198.97.190.53.53: 33898% [1au] AAAA? ns3.a.shifen.com. (57)
13:55:53.755130 IP 10.0.0.103.53 > 10.0.0.201.48287: 30560 3/0/0 CNAME www.a.shifen.com., A 39.156.66.14, A 39.156.66.18 (93)
13:55:53.755213 IP 10.0.0.103.53 > 10.0.0.201.48287: 17000 1/1/0 CNAME www.a.shifen.com. (118)
13:55:53.783146 IP 10.0.0.201.41854 > 10.0.0.103.53: 52709+ PTR? 14.66.156.39.in-addr.arpa. (43)
13:55:53.785435 IP 10.0.0.103.44809 > 198.97.190.53.53: 27680 [1au] A? _.arpa. (47)
13:55:54.048383 IP 198.97.190.53.53 > 10.0.0.103.39508: 16833-| 0/13/1 (269)
13:55:54.051159 IP 198.97.190.53.53 > 10.0.0.103.46140: 33898-| 0/13/1 (269)
13:55:54.052102 IP 198.97.190.53.53 > 10.0.0.103.56677: 394-| 0/13/1 (269)
13:55:54.187236 IP 198.97.190.53.53 > 10.0.0.103.44809: 27680 NXDomain*-| 0/2/1 (360)
13:55:54.450026 IP 10.0.0.103.43622 > 192.58.128.30.53: 18350% [1au] AAAA? ns1.a.shifen.com. (57)
13:55:54.478698 IP 192.58.128.30.53 > 10.0.0.103.43622: 18350-| 0/13/1 (269)
13:55:54.550722 IP 10.0.0.103.36639 > 192.42.93.30.53: 51022% [1au] AAAA? ns1.a.shifen.com. (57)
13:55:54.763749 IP 192.42.93.30.53 > 10.0.0.103.36639: 51022-| 0/7/2 (493)
13:55:55.197781 IP 10.0.0.103.53383 > 110.242.68.134.53: 56541% [1au] AAAA? ns1.a.shifen.com. (57)
13:55:55.238745 IP 110.242.68.134.53 > 10.0.0.103.53383: 56541- 0/5/8 (295)
13:55:55.240193 IP 10.0.0.103.59498 > 112.80.255.253.53: 49612% [1au] AAAA? ns1.a.shifen.com. (57)
13:55:55.292809 IP 112.80.255.253.53 > 10.0.0.103.59498: 49612*- 0/1/1 (135)
13:55:55.374488 IP 10.0.0.103.45433 > 192.58.128.30.53: 10770% [1au] AAAA? ns2.a.shifen.com. (57)
13:55:55.400054 IP 192.58.128.30.53 > 10.0.0.103.45433: 10770-| 0/13/1 (269)
13:55:55.453315 IP 10.0.0.103.51455 > 192.58.128.30.53: 11315% [1au] AAAA? ns3.a.shifen.com. (57)
13:55:55.469677 IP 10.0.0.103.55742 > 192.33.14.30.53: 19216% [1au] AAAA? ns2.a.shifen.com. (57)
13:55:55.482168 IP 192.58.128.30.53 > 10.0.0.103.51455: 11315-| 0/13/1 (269)
13:55:55.516239 IP 10.0.0.103.39363 > 192.58.128.30.53: 11597% [1au] AAAA? ns4.a.shifen.com. (57)
13:55:55.545765 IP 192.58.128.30.53 > 10.0.0.103.39363: 11597-| 0/13/1 (269)
13:55:55.560437 IP 10.0.0.103.33281 > 192.33.14.30.53: 30641% [1au] AAAA? ns3.a.shifen.com. (57)
13:55:55.617652 IP 10.0.0.103.43095 > 192.33.14.30.53: 55045% [1au] AAAA? ns4.a.shifen.com. (57)
13:55:55.698607 IP 10.0.0.103.50316 > 192.58.128.30.53: 38446 [1au] A? _.arpa. (47)
13:55:55.728648 IP 192.58.128.30.53 > 10.0.0.103.50316: 38446 NXDomain*-| 0/2/1 (360)
13:55:55.736730 IP 192.33.14.30.53 > 10.0.0.103.55742: 19216-| 0/7/2 (493)
13:55:55.799297 IP 10.0.0.103.57359 > 199.7.91.13.53: 27988 [1au] DNSKEY? arpa. (45)
13:55:55.825687 IP 192.33.14.30.53 > 10.0.0.103.33281: 30641-| 0/7/2 (493)
13:55:55.883678 IP 192.33.14.30.53 > 10.0.0.103.43095: 55045-| 0/7/2 (493)
13:55:56.034280 IP 199.7.91.13.53 > 10.0.0.103.57359: 27988*-| 0/0/1 (33)
13:55:56.275677 IP 10.0.0.103.50100 > 110.242.68.134.53: 18467% [1au] AAAA? ns2.a.shifen.com. (73)
13:55:56.317354 IP 110.242.68.134.53 > 10.0.0.103.50100: 18467- 0/5/8 (295)
13:55:56.318725 IP 10.0.0.103.54006 > 110.242.68.42.53: 18830% [1au] AAAA? ns2.a.shifen.com. (57)
13:55:56.358230 IP 110.242.68.42.53 > 10.0.0.103.54006: 18830*- 0/1/1 (139)
13:55:56.361710 IP 10.0.0.103.53852 > 220.181.33.31.53: 16690% [1au] AAAA? ns3.a.shifen.com. (73)
13:55:56.391307 IP 220.181.33.31.53 > 10.0.0.103.53852: 16690- 0/5/8 (295)
13:55:56.392702 IP 10.0.0.103.55955 > 220.181.33.32.53: 10139% [1au] AAAA? ns3.a.shifen.com. (57)
13:55:56.419419 IP 10.0.0.103.59885 > 14.215.178.80.53: 4778% [1au] AAAA? ns4.a.shifen.com. (73)
13:55:56.431985 IP 220.181.33.32.53 > 10.0.0.103.55955: 10139*- 0/1/1 (139)
13:55:56.480338 IP 10.0.0.103.47110 > 192.203.230.10.53: 16546 [1au] DS? arpa. (45)
13:55:56.484491 IP 14.215.178.80.53 > 10.0.0.103.59885: 4778- 0/5/8 (295)
13:55:56.485122 IP 10.0.0.103.34869 > 180.76.76.95.53: 31591% [1au] AAAA? ns4.a.shifen.com. (57)
13:55:56.520302 IP 180.76.76.95.53 > 10.0.0.103.34869: 31591*- 0/1/1 (139)
13:55:56.702334 IP 192.203.230.10.53 > 10.0.0.103.47110: 16546*- 3/0/1 DS, DS, RRSIG (404)
13:55:56.703663 IP 10.0.0.103.56113 > 192.33.4.12.53: 4886 [1au] A? _.in-addr.arpa. (55)
13:55:57.500518 IP 10.0.0.103.40776 > 199.7.83.42.53: 22996 [1au] A? _.in-addr.arpa. (55)
13:55:57.535806 IP 199.7.83.42.53 > 10.0.0.103.40776: 22996-| 0/9/1 (299)
13:55:57.605761 IP 10.0.0.103.42726 > 193.0.9.1.53: 53840 [1au] A? _.39.in-addr.arpa. (58)
13:55:57.912536 IP 193.0.9.1.53 > 10.0.0.103.42726: 53840- 0/6/1 (385)
13:55:57.913354 IP 10.0.0.103.42745 > 193.0.14.129.53: 7791% [1au] A? ns2.apnic.net. (54)
13:55:57.913912 IP 10.0.0.103.44117 > 193.0.14.129.53: 16224% [1au] A? rirns.arin.net. (55)
13:55:57.913974 IP 10.0.0.103.39509 > 193.0.14.129.53: 29658% [1au] AAAA? ns2.apnic.net. (54)
13:55:57.914025 IP 10.0.0.103.52994 > 193.0.14.129.53: 41781% [1au] A? ns3.lacnic.net. (55)
13:55:57.914555 IP 10.0.0.103.51150 > 193.0.14.129.53: 29175% [1au] AAAA? ns3.lacnic.net. (55)
13:55:57.914642 IP 10.0.0.103.47428 > 193.0.14.129.53: 62109% [1au] AAAA? rirns.arin.net. (55)
13:55:57.915014 IP 10.0.0.103.41616 > 193.0.14.129.53: 73% [1au] A? apnic.authdns.ripe.net. (63)
13:55:57.915027 IP 10.0.0.103.37848 > 193.0.14.129.53: 47004% [1au] AAAA? apnic.authdns.ripe.net. (63)
13:55:58.286563 IP 193.0.14.129.53 > 10.0.0.103.51150: 29175-| 0/14/1 (312)
13:55:58.286694 IP 193.0.14.129.53 > 10.0.0.103.44117: 16224-| 0/14/1 (312)
13:55:58.291536 IP 193.0.14.129.53 > 10.0.0.103.41616: 73-| 0/14/1 (320)
13:55:58.291537 IP 193.0.14.129.53 > 10.0.0.103.47428: 62109-| 0/13/1 (264)
13:55:58.291537 IP 193.0.14.129.53 > 10.0.0.103.42745: 7791-| 0/13/1 (263)
13:55:58.292438 IP 193.0.14.129.53 > 10.0.0.103.52994: 41781-| 0/0/1 (43)
13:55:58.294146 IP 193.0.14.129.53 > 10.0.0.103.39509: 29658-| 0/13/1 (263)
13:55:58.298987 IP 193.0.14.129.53 > 10.0.0.103.37848: 47004-| 0/13/1 (272)
13:55:58.787534 IP 10.0.0.201.41854 > 10.0.0.103.53: 52709+ PTR? 14.66.156.39.in-addr.arpa. (43)
13:55:59.036598 IP 10.0.0.103.55009 > 192.31.80.30.53: 61669% [1au] A? rirns.arin.net. (55)
13:55:59.037797 IP 10.0.0.103.56016 > 192.31.80.30.53: 20878% [1au] AAAA? ns3.lacnic.net. (55)
13:55:59.043571 IP 10.0.0.103.57319 > 192.31.80.30.53: 40654% [1au] AAAA? ns2.apnic.net. (54)
13:55:59.045637 IP 10.0.0.103.39322 > 192.31.80.30.53: 47663% [1au] A? ns2.apnic.net. (54)
13:55:59.046542 IP 10.0.0.103.52537 > 192.31.80.30.53: 28834% [1au] A? ns3.lacnic.net. (55)
13:55:59.050201 IP 10.0.0.103.36825 > 192.31.80.30.53: 63063% [1au] A? apnic.authdns.ripe.net. (63)
13:55:59.054191 IP 10.0.0.103.56563 > 192.31.80.30.53: 20970% [1au] AAAA? rirns.arin.net. (55)
13:55:59.057545 IP 10.0.0.103.54120 > 192.31.80.30.53: 35517% [1au] AAAA? apnic.authdns.ripe.net. (63)
13:55:59.235574 IP 192.31.80.30.53 > 10.0.0.103.56016: 20878-| 0/9/3 (486)
13:55:59.236651 IP 192.31.80.30.53 > 10.0.0.103.55009: 61669-| 0/6/8 (504)
13:55:59.241347 IP 192.31.80.30.53 > 10.0.0.103.57319: 40654-| 0/6/7 (503)
13:55:59.242984 IP 192.31.80.30.53 > 10.0.0.103.39322: 47663-| 0/6/7 (503)
13:55:59.244539 IP 192.31.80.30.53 > 10.0.0.103.52537: 28834-| 0/9/3 (486)
13:55:59.248573 IP 192.31.80.30.53 > 10.0.0.103.36825: 63063-| 0/7/5 (502)
13:55:59.254080 IP 192.31.80.30.53 > 10.0.0.103.56563: 20970-| 0/6/8 (504)
13:55:59.258508 IP 192.31.80.30.53 > 10.0.0.103.54120: 35517-| 0/7/5 (502)
13:55:59.631255 IP 10.0.0.103.42625 > 200.3.13.11.53: 3605% [1au] AAAA? ns3.lacnic.net. (55)
13:55:59.631656 IP 10.0.0.103.36502 > 202.12.27.33.53: 9023% [1au] A? a.lactld.org. (53)
13:55:59.631698 IP 10.0.0.103.46767 > 202.12.27.33.53: 20794% [1au] AAAA? a.lactld.org. (53)
13:55:59.633048 IP 10.0.0.103.53261 > 199.5.26.108.53: 37405% [1au] A? rirns.arin.net. (55)
13:55:59.633996 IP 10.0.0.103.49487 > 202.12.27.33.53: 64688% [1au] A? ns2.dns.br. (51)
13:55:59.635261 IP 10.0.0.103.34290 > 202.12.27.33.53: 55259% [1au] AAAA? ns2.dns.br. (51)
13:55:59.639356 IP 10.0.0.103.60875 > 202.12.31.53.53: 8861% [1au] AAAA? ns2.apnic.net. (54)
13:55:59.640207 IP 10.0.0.103.59101 > 202.12.31.53.53: 2486% [1au] A? ns2.apnic.net. (54)
13:55:59.644084 IP 10.0.0.103.44917 > 202.12.31.53.53: 8572% [1au] A? ns3.lacnic.net. (55)
13:55:59.647413 IP 10.0.0.103.55250 > 202.12.31.53.53: 24768% [1au] A? apnic.authdns.ripe.net. (63)
13:55:59.656910 IP 10.0.0.103.50589 > 200.3.13.14.53: 60380% [1au] AAAA? apnic.authdns.ripe.net. (63)
13:55:59.659445 IP 10.0.0.103.43429 > 204.61.216.50.53: 35384% [1au] AAAA? rirns.arin.net. (55)
13:55:59.726539 IP 202.12.27.33.53 > 10.0.0.103.49487: 64688- 0/8/3 (504)
13:55:59.726652 IP 202.12.27.33.53 > 10.0.0.103.46767: 20794-| 0/0/1 (41)
13:55:59.727819 IP 10.0.0.103.42923 > 200.219.159.10.53: 58506% [1au] A? ns2.dns.br. (51)
13:55:59.729879 IP 10.0.0.103.48915 > 192.36.148.17.53: 43442% [1au] A? a.dns.br. (65)
13:55:59.730332 IP 10.0.0.103.54019 > 192.36.148.17.53: 61276% [1au] AAAA? a.dns.br. (65)
13:55:59.730607 IP 10.0.0.103.42868 > 192.36.148.17.53: 21644% [1au] A? c.dns.br. (65)
13:55:59.730769 IP 10.0.0.103.35475 > 192.36.148.17.53: 47763% [1au] AAAA? c.dns.br. (65)
13:55:59.741643 IP 192.36.148.17.53 > 10.0.0.103.48915: 43442- 0/8/13 (760)
13:55:59.742430 IP 192.36.148.17.53 > 10.0.0.103.54019: 61276- 0/8/13 (760)
13:55:59.746003 IP 192.36.148.17.53 > 10.0.0.103.42868: 21644- 0/8/13 (760)
13:55:59.746004 IP 192.36.148.17.53 > 10.0.0.103.35475: 47763- 0/8/13 (760)
13:55:59.746004 IP 202.12.27.33.53 > 10.0.0.103.36502: 9023-| 0/0/1 (41)
13:55:59.749738 IP 202.12.27.33.53 > 10.0.0.103.34290: 55259- 0/8/3 (504)
13:55:59.774862 IP 204.61.216.50.53 > 10.0.0.103.43429: 35384*- 2/0/1 AAAA 2620:38:2000::53, RRSIG (267)
13:55:59.786719 IP 10.0.0.103.53 > 10.0.0.201.41854: 52709 ServFail 0/0/0 (43)
13:55:59.855567 IP 199.5.26.108.53 > 10.0.0.103.53261: 37405*- 2/0/1 A 199.253.249.53, RRSIG (255)
13:55:59.864364 IP 202.12.31.53.53 > 10.0.0.103.44917: 8572*- 2/0/1 A 200.3.13.14, RRSIG (385)
13:55:59.878843 IP 200.219.159.10.53 > 10.0.0.103.42923: 58506*- 2/0/1 A 200.192.232.53, RRSIG (195)
13:55:59.947950 IP 202.12.31.53.53 > 10.0.0.103.59101: 2486*- 2/0/1 A 203.119.95.53, RRSIG (191)
13:55:59.947950 IP 202.12.31.53.53 > 10.0.0.103.60875: 8861*- 2/0/1 AAAA 2001:ddd::53, RRSIG (203)
13:55:59.959106 IP 202.12.31.53.53 > 10.0.0.103.55250: 24768*- 2/0/1 A 193.0.9.9, RRSIG (199)
13:56:00.001078 IP 200.3.13.11.53 > 10.0.0.103.42625: 3605*- 2/0/1 AAAA 2001:13c7:7002:3000::14, RRSIG (397)
13:56:00.087116 IP 200.3.13.14.53 > 10.0.0.103.50589: 60380*- 2/0/1 AAAA 2001:67c:e0::9, RRSIG (211)

第二次递归查询

[root@client ~]# ping -c1 www.baidu.com
...


root@dns-server:~# tcpdump -nn -i eth0 -p udp port 53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
13:57:43.598476 IP 10.0.0.201.51413 > 10.0.0.103.53: 41698+ A? www.baidu.com. (31)
13:57:43.598477 IP 10.0.0.201.51413 > 10.0.0.103.53: 39913+ AAAA? www.baidu.com. (31)
13:57:43.599050 IP 10.0.0.103.53 > 10.0.0.201.51413: 41698 3/0/0 CNAME www.a.shifen.com., A 39.156.66.14, A 39.156.66.18 (93)
13:57:43.599285 IP 10.0.0.103.53 > 10.0.0.201.51413: 39913 1/1/0 CNAME www.a.shifen.com. (118)
13:57:43.626930 IP 10.0.0.201.48905 > 10.0.0.103.53: 34917+ PTR? 14.66.156.39.in-addr.arpa. (43)
13:57:43.628728 IP 10.0.0.103.43522 > 199.253.249.53.53: 4513 [1au] A? _.156.39.in-addr.arpa. (62)
13:57:43.856101 IP 199.253.249.53.53 > 10.0.0.103.43522: 4513- 0/4/1 (333)
13:57:43.857201 IP 10.0.0.103.39909 > 192.35.51.30.53: 55324% [1au] A? ns.cnmobile.net. (56)
13:57:43.857894 IP 10.0.0.103.59854 > 192.35.51.30.53: 60693% [1au] AAAA? ns.cnmobile.net. (56)
13:57:43.858423 IP 10.0.0.103.34463 > 192.35.51.30.53: 63720% [1au] A? ns2.cnmobile.net. (57)
13:57:43.859129 IP 10.0.0.103.53343 > 192.35.51.30.53: 13966% [1au] AAAA? ns2.cnmobile.net. (57)
13:57:44.077201 IP 192.35.51.30.53 > 10.0.0.103.59854: 60693-| 0/6/2 (464)
13:57:44.077334 IP 192.35.51.30.53 > 10.0.0.103.39909: 55324-| 0/6/2 (464)
13:57:44.078971 IP 192.35.51.30.53 > 10.0.0.103.34463: 63720-| 0/6/2 (464)
13:57:44.081748 IP 192.35.51.30.53 > 10.0.0.103.53343: 13966-| 0/6/2 (464)
13:57:44.518233 IP 10.0.0.103.53628 > 211.136.17.105.53: 20711% [1au] A? ns.cnmobile.net. (56)
13:57:44.519003 IP 10.0.0.103.60766 > 211.136.20.201.53: 5911% [1au] A? ns2.cnmobile.net. (57)
13:57:44.520353 IP 10.0.0.103.34705 > 211.136.20.201.53: 41680% [1au] AAAA? ns.cnmobile.net. (56)
13:57:44.521041 IP 10.0.0.103.36711 > 211.136.20.201.53: 37507% [1au] AAAA? ns2.cnmobile.net. (57)
13:57:44.545306 IP 211.136.17.105.53 > 10.0.0.103.53628: 20711*- 1/3/8 A 211.136.17.105 (270)
13:57:44.546336 IP 10.0.0.103.34313 > 211.136.20.201.53: 49460 [1au] A? _.66.156.39.in-addr.arpa. (65)
13:57:44.546963 IP 211.136.20.201.53 > 10.0.0.103.34705: 41680*- 1/3/8 AAAA 2409:8080::3 (270)
13:57:44.547524 IP 211.136.20.201.53 > 10.0.0.103.60766: 5911*- 1/3/8 A 211.136.20.201 (270)
13:57:44.549216 IP 211.136.20.201.53 > 10.0.0.103.36711: 37507*- 1/3/8 AAAA 2409:8080::4 (270)
13:57:44.576806 IP 211.136.20.201.53 > 10.0.0.103.34313: 49460- 0/2/1 (111)
13:57:44.578022 IP 10.0.0.103.37901 > 192.12.94.30.53: 27782% [1au] A? dns01.bj.chinamobile.com. (65)
13:57:44.578125 IP 10.0.0.103.41004 > 192.12.94.30.53: 9303% [1au] A? dns02.bj.chinamobile.com. (65)
13:57:44.578261 IP 10.0.0.103.55326 > 192.12.94.30.53: 17839% [1au] AAAA? dns02.bj.chinamobile.com. (65)
13:57:44.578692 IP 10.0.0.103.58728 > 192.12.94.30.53: 21605% [1au] AAAA? dns01.bj.chinamobile.com. (65)
13:57:44.779946 IP 192.12.94.30.53 > 10.0.0.103.55326: 17839-| 0/6/1 (472)
13:57:44.780190 IP 192.12.94.30.53 > 10.0.0.103.41004: 9303-| 0/6/1 (472)
13:57:44.781414 IP 192.12.94.30.53 > 10.0.0.103.37901: 27782-| 0/6/1 (472)
13:57:44.785049 IP 192.12.94.30.53 > 10.0.0.103.58728: 21605-| 0/6/1 (472)
13:57:45.185912 IP 10.0.0.103.37699 > 211.136.17.105.53: 63840% [1au] A? dns01.bj.chinamobile.com. (65)
13:57:45.186488 IP 10.0.0.103.52392 > 211.136.17.105.53: 8215% [1au] AAAA? dns02.bj.chinamobile.com. (65)
13:57:45.187021 IP 10.0.0.103.46850 > 211.136.17.105.53: 29486% [1au] A? dns02.bj.chinamobile.com. (65)
13:57:45.187747 IP 10.0.0.103.49596 > 211.136.17.105.53: 37957% [1au] AAAA? dns01.bj.chinamobile.com. (65)
13:57:45.213871 IP 211.136.17.105.53 > 10.0.0.103.46850: 29486- 0/2/3 (119)
13:57:45.213871 IP 211.136.17.105.53 > 10.0.0.103.52392: 8215- 0/2/3 (119)
13:57:45.214432 IP 10.0.0.103.51175 > 221.130.33.132.53: 1617% [1au] AAAA? dns02.bj.chinamobile.com. (65)
13:57:45.214795 IP 10.0.0.103.35258 > 221.130.33.132.53: 41758% [1au] A? dns02.bj.chinamobile.com. (65)
13:57:45.216473 IP 211.136.17.105.53 > 10.0.0.103.37699: 63840- 0/2/3 (119)
13:57:45.216473 IP 211.136.17.105.53 > 10.0.0.103.49596: 37957- 0/2/3 (119)
13:57:45.217225 IP 10.0.0.103.50497 > 221.130.33.132.53: 39647% [1au] AAAA? dns01.bj.chinamobile.com. (65)
13:57:45.217962 IP 10.0.0.103.53569 > 221.130.33.132.53: 49580% [1au] A? dns01.bj.chinamobile.com. (65)
13:57:45.240150 IP 221.130.33.132.53 > 10.0.0.103.35258: 41758*- 1/0/1 A 221.130.33.132 (69)
13:57:45.241208 IP 10.0.0.103.32849 > 211.136.25.4.53: 12136 [1au] PTR? 14.66.156.39.in-addr.arpa. (66)
13:57:45.242740 IP 221.130.33.132.53 > 10.0.0.103.50497: 39647*- 1/0/1 AAAA 2409:8000:2000:0:190::1 (81)
13:57:45.242740 IP 221.130.33.132.53 > 10.0.0.103.51175: 1617*- 1/0/1 AAAA 2409:8000:2000:0:90::1 (81)
13:57:45.245123 IP 221.130.33.132.53 > 10.0.0.103.53569: 49580*- 1/0/1 A 211.136.25.4 (69)
13:57:45.270223 IP 211.136.25.4.53 > 10.0.0.103.32849: 12136 NXDomain*- 0/1/1 (119)
13:57:45.271254 IP 10.0.0.103.46081 > 200.10.60.53.53: 32696 [1au] DNSKEY? in-addr.arpa. (53)
13:57:46.072082 IP 10.0.0.103.49221 > 196.216.169.10.53: 26782 [1au] DNSKEY? in-addr.arpa. (53)
13:57:46.565312 IP 196.216.169.10.53 > 10.0.0.103.49221: 26782*-| 0/0/1 (41)
13:57:47.537772 IP 10.0.0.103.55198 > 193.0.9.9.53: 57661 [1au] DS? 156.39.in-addr.arpa. (60)
13:57:47.841369 IP 193.0.9.9.53 > 10.0.0.103.55198: 57661*- 0/4/1 (440)
13:57:47.842158 IP 10.0.0.103.44032 > 203.119.95.53.53: 11916 [1au] DNSKEY? 39.in-addr.arpa. (56)
13:57:48.112424 IP 203.119.95.53.53 > 10.0.0.103.44032: 11916*-| 0/0/1 (72)
13:57:48.635369 IP 10.0.0.201.48905 > 10.0.0.103.53: 34917+ PTR? 14.66.156.39.in-addr.arpa. (43)
13:57:48.670464 IP 10.0.0.103.53 > 10.0.0.201.48905: 34917 NXDomain 0/0/0 (43)

第三次查询，缓存返回结果

[root@client ~]# ping -c1 www.baidu.com
...

root@dns-server:~# tcpdump -nn -i eth0 -p udp port 53
14:00:17.303198 IP 10.0.0.201.50477 > 10.0.0.103.53: 18013+ A? www.baidu.com. (31)
14:00:17.303198 IP 10.0.0.201.50477 > 10.0.0.103.53: 40801+ AAAA? www.baidu.com. (31)
14:00:17.303534 IP 10.0.0.103.53 > 10.0.0.201.50477: 18013 3/0/0 CNAME www.a.shifen.com., A 39.156.66.14, A 39.156.66.18 (93)
14:00:17.303665 IP 10.0.0.103.53 > 10.0.0.201.50477: 40801 1/1/0 CNAME www.a.shifen.com. (118)
14:00:17.331653 IP 10.0.0.201.59444 > 10.0.0.103.53: 29256+ PTR? 14.66.156.39.in-addr.arpa. (43)
14:00:17.332677 IP 10.0.0.103.47508 > 211.136.25.4.53: 30955 [1au] PTR? 14.66.156.39.in-addr.arpa. (66)
14:00:17.359647 IP 211.136.25.4.53 > 10.0.0.103.47508: 30955 NXDomain*- 0/1/1 (119)
14:00:17.360714 IP 10.0.0.103.53 > 10.0.0.201.59444: 29256 NXDomain 0/0/0 (43)

dig 采集详情

  • 此工具需要安装 bind-utils 包
[root@client ~]# dig www.baidu.com

; <<>> DiG 9.11.36-RedHat-9.11.36-3.el8 <<>> www.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4028
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 32e41ffe022a1e5c0100000062c3d5c133d8f1d7b25804d4 (good)
;; QUESTION SECTION:
;www.baidu.com.			IN	A

;; ANSWER SECTION:
www.baidu.com.		343	IN	CNAME	www.a.shifen.com.
www.a.shifen.com.	240	IN	A	39.156.66.18
www.a.shifen.com.	240	IN	A	39.156.66.14

;; Query time: 1 msec
;; SERVER: 10.0.0.103#53(10.0.0.103)
;; WHEN: Tue Jul 05 14:10:09 CST 2022
;; MSG SIZE  rcvd: 132