What is DNS or domain name system.
In this video I'm going to explain it in a lot of detail but before we get there Alexa N.S. look up
Amazon.com.
The DNS lookout for Amazon dot com is 176 dot 32 dot 103 dot 205.
That is an example of what a DNS does.
It's essentially resolving a name typically a domain name to an IP address.
N S look up a Google dot com DNS look up for Google dot com is 172 dot 217 dot 164 dot 142.
We as humans don't communicate easily using IP addresses.
We use domain names.
So if I told you to go to Google's IP address you probably don't even remember what the IP address was
but you'll remember what Google dot com is so DNS essentially resolves a human readable name such as
Google dot com or Amazon.com to a machine readable IP address.
Machines don't use names they use IP addresses in IP version 4 we use dotted decimal notation IP addresses
such as 1 9 2 1 6 8 wandered 1 IP 6 uses IP addresses such as 2001 colon colon 1 2 3.
There are many IP addresses out there and many Web sites.
It's much easier to remember a domain name once again like Facebook dot com or Amazon.com rather than
the IP address of a server.
And to further complicate it like in my example depending where you're on the world a domain name may
resolve to a different IP address for load balancing.
So if I'm in the UK and I ping Google dot com I may get a different result to you if you in the US or
in Singapore or somewhere else in the world.
It's much easier to remember the domain name than it is to remember an IP address but machines use IP
addresses and traffic is routed across the Internet using IP addresses not names.
DNS is a fundamental building block in networks today without a DNS internet wouldn't really work very
well because very few of us are going to remember IP addresses.
Now as an analogy DNS is like a telephone book taking a name converting it to a telephone number.
But in this case taking a domain name and converting it to an IP address in the bad old days I'd have
to look up someone's number in a book and then I'd have to manually dial their telephone number.
But I don't think any of us do that these days on a phone like an iPhone today we're not going to manually
type a number like this and then dial it we're going to go to our contacts and search for a contact
and then just press on the contact to call the person.
I mean a lot of us probably don't even know our own telephone numbers these days.
We don't know the telephone numbers of other people because we simply look them up in a directory on
our phone.
Now this is a local directory.
We can do something very similar on a P.C. by using what's called a hosts file.
That is the most basic version of so-called DNS.
No it's not DNS but it's a local lookup so you could create your own version of DNS locally on your
P.C. by editing the hosts file.
Taking that a step further companies may have a local DNS server that resolves and names within the
organization but on the public Internet we have distributed DNS systems that allow us to resolve names
such as Google Facebook etc..
Now it's all very good and while talking about DNS but I want to show you practically how it works I'm
going to show you why shock captures I'm going to show you how to setup a DNS server on a Cisco rider.
How to set it up on a country server.
I'll show you basically how you can manipulate a DNS to do anything that you want.
You need to be careful that you use trusted DNS servers.
Don't just trust any DNS server out there.
DNS can be intercepted and you can manipulate the DNS servers used by pieces to get them to go to the
incorrect domain.
Fortunately today a lot of browsers like Chrome have a whole list of certificates preloaded on them
so you'll get a warning if you end up going to an incorrect domain such as Microsoft dot com or Cisco
dot com.
Okay so in this topology I've got a Windows 10 computer it's connected to a Cisco switch which in turn
is connected to a Cisco rather which connects us to the Internet.
This topology is running in Genesis 3.
I'm hosting this entire topology on my computer so forgive me if the fan goes a bit crazy.
It's all running locally on my Mac.
I also have an a bunch too P.C. which will configure as a DNS server.
Okay firstly let's have a look at the Windows computer.
Here's my windows.
P.S. I'll open up a seam deep prompt.
Make this a bit bigger.
IP config shows me that this is the IP address of the P.C. IP version 4 default gateways 10 1 1 2 5
4 and I should at this point be able to paying my default gateway which I can default gateway.
Is this Cisco with IP address once again 10 1 1 2 5 4.
The switch is a lever to switch it's not really doing anything except giving connectivity in the network.
So back on the P.C. IP config slash all shows us that the CPC has to DNS servers configured 8 8 8 8
8 and wandered wandered wandered 1.
In other words Google and CloudFlare are the two DNS servers configured on the P.C. so I'll start a
wire shock capture between the P.C. and the switch so that we can see what's actually going on.
Windows sends a lot of traffic into the network so as you can see here a bunch of traffic is being sent
by that Windows computer out into the network.
But I'm going to filter for DNS and then back on the P.C. what I'll do is ping a domain such as David
Bumble dot com.
And notice we get a reply from this IP address 2 1 7 160 0 sixty nine.
Now the CBO spiking on my P.C. here the throughput through a Cisco switch and a Cisco broad are running
in June 3 may be a bit slow but the point is is that I am getting replies back to that domain and if
we have a look at the Y shock capture what you'll notice is we can see that this IP address 10 1 1 1
cent a DNS request 2 8 8 8 8 8 for domain David Bumble dot com.
So just to confirm on the P.C. once again IP config shows us that this is the IP address of the P.C.
the P.C. send a request to the DNS server notice the query is for David Bumble dot com.
It's a record a record is a domain name in IP version 4 could triple A is a domain name in IP version
6.
So the P.C. is asking the DNS server what the IP address is of the domain name now going back a step
at a layer 2 in the OS model or TTP IP model if you prefer we have Ethernet to.
That's because this network is using ethernet so it's an ethernet connection from the windows P.C. to
the Ethernet switch the source mac addresses the P.C. destination MAC address is the broader basically
the traffic is being switched from the P.C. to the broader because that's how it gets onto the Internet.
So at least to source MAC address will be the P.C. destination MAC address will be the broader but at
least three IP version 4 source IP addresses the P.C. destination IP address is Google.
Now you may notice that this is a RF C 1918 address.
In other words it's a private IP address it's non-refundable.
On the internet but the router is implementing network address translation or Nat.
This is very typical of what your right at home will be doing.
So notice it's enacting this IP address.
Now it is narrowing it to a another ROIC 1918 address but that's because this road is connected to a
cloud which is actually bridging my P.C. physically.
So this P.C. here onto my physical home network and I have an Internet router that runs this onto the
Internet.
So it's actually being nutted multiple times.
But what's important to point out here is notice the protocol at least for each UDP or user data grand
protocol source port number use this 5 2 7 4 9.
That is what's called any femoral or random port number.
Destination Port numbers 53 which is the well-known port number for DNS.
When a server is configured to host multiple services it's got to serve a purpose.
So it's a server that's acting as let's say a file server when you connect to that server it's going
to give you a file.
But when you connect to it using DNS it's listening on Port 53.
If it's being configured as a DNS server so you send traffic to port 53 the server is listening on Port
53 to running an application like which I'll show you in a moment DNS mosque which is a DNS server application
and then it responds back to that to request on the port number that you chose.
So if you connect to a DNS server like this piece is doing you will use a random port number or ephemeral
port number going to a well-known port number and then it'll reply back from that well-known port number
and we can see that here Google is replying from a source port number 53 going to the port number that
the P.C. chose the Windows 10 piece he chose this port number.
The Google DNS server replies back to that port number so again it's UDP destination port number as
a source port number as this.
Digging deeper into the DNS information we can see.
Domain Name System.
It's a query.
It's a standard query for a name.
We're trying to resolve a name the name that we resolving.
Is David Bumble dot com and the DNS server replies back saying this is the answer.
This domain name has this IP address 2 1 7 160 0 69.
So back on our windows P.S. That is the IP address that we see.
So I could copy that IP address go to a web browser.
If I type the domain name it's going to browse to that server.
So I'm able to connect to the domain using the domain name.
And this depends on the server I should be able to connect to the IP address of the server.
In this example I'm getting a form for error.
Now some servers will not allow you to connect directly on the IP address.
That's typically because multiple domains are hosted on a single IP address Okay I'll stop the Y shock
capture and what I want to show you once again is that DNS is essentially just a resolution of name
to IP address and you can do that directly on your Windows computer.
So in windows I'll open up notepad.
I'll run this as an administrator
before I open a file if I pinged brought a 1 notice we told that that domain name is not found the same
with right of one whom dot com the ping request times out.
I can't ping that domain name but what I could do is open a file and what I'm going to do is go to see
Windows system 32 driver's Etsy and I'm going to open the hosts file.
This is a file on the local Windows computer.
Just zoom in there to make it easier to read and I can edit this so I could say 10 1 1 2 5 4 is right
1 and 10 1 1 1 2 5 4 was write a one whom dot com and save that file.
So I'm editing a local file that maps whose names to IP addresses.
So now when I ping wrote a one notice that works when I ping write a one dot home dot com that also
works.
But if I ping wrote it to that fails because it's not in the hosts file and Google is not replying back
with that information.
So if I said or two like this and save that file now ping or two that resolves name got resolved to
an IP address.
Now in this example the networks a bit unstable sort of pings a timing out they had succeeded.
But the important part is the domain name got resolved.
That name got resolved to an IP address.
If I remove these entries from the hosts file and save it
I'll clear the screen there.
When I ping are one now that's going to timeout because I don't have an entry for that domain name.
That's essentially what a DNS server does.
It takes a domain name and maps it to an IP address.