108 lines
2.8 KiB
Plaintext
108 lines
2.8 KiB
Plaintext
I)
|
|
1)
|
|
cat /etc/resolv.conf
|
|
|
|
nameserver 172.16.1.252
|
|
nameserver 172.16.1.253
|
|
nameserver 2a01:729:b9:1600:172:16:1:252
|
|
|
|
2)
|
|
nslookup
|
|
|
|
II)
|
|
|
|
1)
|
|
tshark -i eno1 -f "port 53" -Y "dns" > toto.txt
|
|
|
|
2)
|
|
dig iluvatar.arda.lan
|
|
|
|
; <<>> DiG 9.20.1 <<>> iluvatar.arda.lan
|
|
;; global options: +cmd
|
|
;; Got answer:
|
|
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25260
|
|
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
|
|
|
|
;; OPT PSEUDOSECTION:
|
|
; EDNS: version: 0, flags:; udp: 1232
|
|
; COOKIE: aebbfe066ab546b40100000067d96d9be17445f5f41a8da3 (good)
|
|
;; QUESTION SECTION:
|
|
;iluvatar.arda.lan. IN A
|
|
|
|
;; ANSWER SECTION:
|
|
iluvatar.arda.lan. 3600 IN A 172.16.1.30
|
|
|
|
;; Query time: 0 msec
|
|
;; SERVER: 172.16.1.252#53(172.16.1.252) (UDP)
|
|
;; WHEN: Tue Mar 18 13:56:59 CET 2025
|
|
;; MSG SIZE rcvd: 90
|
|
|
|
|
|
1 0.000000000 172.16.2.124 → 172.16.1.252 DNS 100 Standard query 0x4574 A iluvatar.arda.lan OPT
|
|
2 0.001033119 172.16.1.252 → 172.16.2.124 DNS 132 Standard query response 0x4574 A iluvatar.arda.lan A 172.16.1.30 OPT
|
|
|
|
Pareil avec arda.com :
|
|
|
|
dig arda.com
|
|
|
|
1 0.000000000 172.16.2.124 → 172.16.1.252 DNS 91 Standard query 0x1c20 A arda.com OPT
|
|
2 0.001175188 172.16.1.252 → 172.16.2.124 DNS 171 Standard query response 0x1c20 A arda.com A 3.162.38.2 A 3.162.38.111 A 3.162.38.15 A 3.162.38.37 OPT
|
|
|
|
3)
|
|
Nous pouvons constaté qu'il y a un A signifiant que c'est de l'IPV4
|
|
|
|
|
|
4)
|
|
tshark -i eno1 -V -l -l -f "port 53" -Y "dns" | tee toto.txt
|
|
|
|
Flags: 0x8180 Standard query response, No error
|
|
1... .... .... .... = Response: Message is a response
|
|
.000 0... .... .... = Opcode: Standard query (0)
|
|
.... .0.. .... .... = Authoritative: Server is not an authority for domain
|
|
.... ..0. .... .... = Truncated: Message is not truncated
|
|
.... ...1 .... .... = Recursion desired: Do query recursively
|
|
.... .... 1... .... = Recursion available: Server can do recursive queries
|
|
.... .... .0.. .... = Z: reserved (0)
|
|
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
|
|
.... .... ...0 .... = Non-authenticated data: Unacceptable
|
|
.... .... .... 0000 = Reply code: No error (0)
|
|
Questions: 1
|
|
Answer RRs: 0
|
|
Authority RRs: 1
|
|
Additional RRs: 0
|
|
|
|
|
|
sur le dig iluvatar.arda.lan :
|
|
|
|
flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
|
|
|
|
|
|
5)
|
|
|
|
Le serveur a l'authorité sur le domain quand on a le aa si nous n'avons pas de aa il n'y a pas d'authorité
|
|
|
|
6)
|
|
|
|
Le temps de vie (TTL) est de 64 cela permet de ne pas avoit de paquet zombie, tournant à l'infini dans le réseaux.
|
|
|
|
7)
|
|
|
|
tcpdump -i eno1 -vvv -l -f "port 53" | tee tcpdump.txt
|
|
|
|
|
|
|
|
III)
|
|
|
|
1)
|
|
|
|
Le TTL jusqu'a vintage.com est de 60
|
|
|
|
|
|
; ANSWER SECTION:
|
|
vintage.com. 60 IN A 86.105.245.69
|
|
|
|
Puis on constate que le dig 1 seconde a près a perdu 1 de TTL.
|
|
|
|
; ANSWER SECTION:
|
|
vintage.com. 59 IN A 86.105.245.69
|