Answer TTL

Answer TTL Field

A DNS answer carries a TTL field beside its answer data.

highlighted = computed this step

TTL lives inside the answer

After the compressed name, the answer record carries type, class, TTL, length, and address bytes.

TTL=300\text{TTL}=300
Answer TTL fieldThe answer record is decoded from the exact DNS response bytes.Answer NAME pointer16 bits / 2 bytes0xc00cbyte 0byte 11100000000001100markeroffset12marker: 3Answer record fields112 bits / 14 bytes0x000100010000012c00045db8d822byte 0byte 1byte 2byte 300000000000000010000000000000001byte 4byte 5byte 6byte 700000000000000000000000100101100byte 8byte 9byte 10byte 1100000000000001000101110110111000byte 12byte 131101100000100010type0x0001class0x0001ttl300rdlength4rdata93.184.216.34(cont.)

The name is still a pointer

The answer NAME is pointer 0xc00c, targeting offset 12.

0xc00c→120xc00c\to12
Answer TTL fieldThe answer record is decoded from the exact DNS response bytes.Answer NAME pointer16 bits / 2 bytes0xc00cbyte 0byte 11100000000001100markeroffset12marker: 3Answer record fields112 bits / 14 bytes0x000100010000012c00045db8d822byte 0byte 1byte 2byte 300000000000000010000000000000001byte 4byte 5byte 6byte 700000000000000000000000100101100byte 8byte 9byte 10byte 1100000000000001000101110110111000byte 12byte 131101100000100010type0x0001class0x0001ttl300rdlength4rdata93.184.216.34(cont.)

The TTL value is exact

The TTL field is 0x0000012c, which is decimal 300.

TTL=300\text{TTL}=300
Answer TTL fieldThe answer record is decoded from the exact DNS response bytes.Answer NAME pointer16 bits / 2 bytes0xc00cbyte 0byte 11100000000001100markeroffset12marker: 3Answer record fields112 bits / 14 bytes0x000100010000012c00045db8d822byte 0byte 1byte 2byte 300000000000000010000000000000001byte 4byte 5byte 6byte 700000000000000000000000100101100byte 8byte 9byte 10byte 1100000000000001000101110110111000byte 12byte 131101100000100010type0x0001class0x0001ttl300rdlength4rdata93.184.216.34(cont.)

Summary

The answer TTL is a field in the response, next to the answer address bytes.

answer type=1\text{answer type}=1
Answer TTL fieldThe answer record is decoded from the exact DNS response bytes.Answer NAME pointer16 bits / 2 bytes0xc00cbyte 0byte 11100000000001100markeroffset12marker: 3Answer record fields112 bits / 14 bytes0x000100010000012c00045db8d822byte 0byte 1byte 2byte 300000000000000010000000000000001byte 4byte 5byte 6byte 700000000000000000000000100101100byte 8byte 9byte 10byte 1100000000000001000101110110111000byte 12byte 131101100000100010type0x0001class0x0001ttl300rdlength4rdata93.184.216.34(cont.)