0

I have a question about DNS query Format ....

I know this structure as the structure of DNS query header ...

typedef struct _DNS_HEADER {
    unsigned short id;       // identification number
    unsigned char qr :1;     // query/response flag
    unsigned char opcode :4; // purpose of message
    unsigned char aa :1;     // authoritative answer
    unsigned char tc :1;     // truncated message
    unsigned char rd :1;     // recursion desired
    unsigned char ra :1;     // recursion available
    unsigned char z :1;      // its z! reserved
    unsigned char ad :1;     // authenticated data
    unsigned char cd :1;     // checking disabled
    unsigned char rcode :4;  // response code
    unsigned short q_count;  // number of question entries
    unsigned short ans_count; // number of answer entries
    unsigned short auth_count; // number of authority entries
    unsigned short add_count; // number of resource entries
} DNS_HEADER;

+ question query and ...

but there is a problem here: I created a socket socket(AF_INET,SOCK_DGRAM,IPPROTO_UDP) and i created a query request:

id = htons(10000);
qr = 0;
opcode = 0
aa = 0
tc = 0
rd = 1
ra = 0
z = 0 
ad = 0
cd = 0
q_count = 1
ans_count = 0
auth_count = 0
add_count = 0

and my question ->

3,'w','w','w',4,'s','i','t','e',3,'c','o','m',0

TYPE = htons(1)
CLASS = htons(1)

I sent this request to my special DNS server (bind) and I think there was a problem. Sometimes DNS server didn't responded me and even on response, it wasn't a true response (everything was 0 and nothing received except same header (12-BYTE))

I searched and I found out that there is a problem with my DNS header and it Must be like this ->

typedef struct _DNS_HEADER {
    unsigned short id;       // identification number

    unsigned char rd :1;     // recursion desired
    unsigned char tc :1;     // truncated message
    unsigned char aa :1;     // authoritative answer
    unsigned char opcode :4; // purpose of message
    unsigned char qr :1;     // query/response flag

    unsigned char rcode :4;  // response code
    unsigned char cd :1;     // checking disabled
    unsigned char ad :1;     // authenticated data
    unsigned char z :1;      // its z! reserved
    unsigned char ra :1;     // recursion available

    unsigned short q_count;  // number of question entries
    unsigned short ans_count; // number of answer entries
    unsigned short auth_count; // number of authority entries
    unsigned short add_count; // number of resource entries
} DNS_HEADER;

something about little-big endian. I changed my structure to this structure and I sent request and DONE - everything worked and there wasn't any problem, but this is my problem: I don't get it what this is this. Yes, I read about little-big endian a little but still i don't get it:

  1. Why haven't other websites that teaches about DNS format mentioned this? They teach with the first structure.
  2. What is this? Why we must change the higher 8 bits of the second 16 bits to be the lower 8 bits of the second 16 bits?
4
  • Note that bitfield layout is in no way portable, and you'd better off using an array of unsigned char to map to the packet contents. Jan 4, 2020 at 21:59
  • There are usually some ENDIANESS #ifdef's around the bitfields to place them in the correct order. This particular DNS_HEADER won't work everywhere as @AnttiHaapala noticed.
    – Ted Lyngmo
    Jan 4, 2020 at 22:04
  • Standard C does not even promise that unsigned char can be used as a bitfield type. Jan 4, 2020 at 22:08
  • @AnttiHaapala Oh ... and I just read "Multiple adjacent bit fields are usually packed together (although this behavior is implementation-defined)" about C++. I was under the impression that was required.
    – Ted Lyngmo
    Jan 4, 2020 at 22:18

1 Answer 1

0

Why haven't other websites that teaches about DNS format mentioned this? They teach with the first structure.

I can't possibly answer that. Most networking litterature I've come across mentions network byte order and the motivation for it.

Why we must change the higher 8 bits of the second 16 bits to be the lower 8 bits of the second 16 bits?

The motivation for it is found in "[IEN-137] Cohen, D., "ON HOLY WARS AND A PLEA FOR PEACE", IEN 137, USC/ISI, April 1980." that is referred to in a Internet Engineering Task Force draft: Network Byte Order

Background and Motivation

The document "ON HOLY WARS AND A PLEA FOR PEACE" [IEN-137] written in 1980 argues that the industry should settle on a single byte order. Since then, the IETF has largely settled on a single byte order known as "Network Byte Order" and this memo is intended to record that rough concensus. Unfortunately, the "holy war" continues among CPU manufacturers.

The last sentence is what this comes down to.

Some CPU models use Big-Endian and others use Little-Endian. There are even those using a mix.

Two bytes (in binary form) representing a std::uint16_t:

Big-Endian: 10000000 00000000 means ‭32768‬ (decimal).
Little-Endian: 10000000 00000000 means ‭128 (decimal).

If there was no agreement on how to interpret these two bytes, communication would be very hard.

2
  • 2
    This actually is not a full answer. OP's structure that didn't work used the order AA,TC,RD, whereas the structure that did work ordered these RD,TC,AA. These three bits are in the same byte, meaning that not only are the bytes reversed, but the bits are reversed also. Big vs. little endian is normally about the byte order, not the bit order; ie, 0xABCD vs 0xCDAB, but AB and CD themselves are the same on either big- or little-endian machines. Thus there is also a separate issue of the compiler's interpretation of bit fields.
    – Kevin
    Mar 23, 2021 at 23:28
  • @Kevin That's true. For struct definitions with bit fields that are targeted fo be used by different implementations one will usually find some #ifdefs that places the bitfields in different order so the resulting data will be properly packaged. Looking at the DNS HEADER layout, one would think that OP:s original struct definition would work, but it did not in that implementation because it packages the bit fields from LSb to MSb, which I assume is common in little endian environments.
    – Ted Lyngmo
    Mar 24, 2021 at 7:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.