The Query

The Header

The DNS header fixes the identity, flags, and section counts. The strip shows those fields exactly as they appear before the variable-length question.

highlighted = computed this step

Why the header comes first

The DNS header gives the transaction identity and section counts before the variable-length name appears. The strip pins each field in wire order.

ID=0x1234\text{ID}=0x1234
DNS headerThe DNS query header is decoded from exact bytes.DNS header96 bits / 12 bytes0x123401000001000000000000byte 0byte 1byte 2byte 300010010001101000000000100000000byte 4byte 5byte 6byte 700000000000000010000000000000000byte 8byte 9byte 10byte 1100000000000000000000000000000000id0x1234flags0x0100qdcount1ancount0nscount0arcount0

ID and flags

The ID is 0x1234. The flags word is 0x0100, with RD set to 1.

0x1234,0x01000x1234,\quad0x0100
DNS headerThe DNS query header is decoded from exact bytes.DNS header96 bits / 12 bytes0x123401000001000000000000byte 0byte 1byte 2byte 300010010001101000000000100000000byte 4byte 5byte 6byte 700000000000000010000000000000000byte 8byte 9byte 10byte 1100000000000000000000000000000000id0x1234flags0x0100qdcount1ancount0nscount0arcount0

Question and answer counts

QDCOUNT is 1, while ANCOUNT, NSCOUNT, and ARCOUNT are all 0.

QD=1,AN=0\text{QD}=1,\quad\text{AN}=0
DNS headerThe DNS query header is decoded from exact bytes.DNS header96 bits / 12 bytes0x123401000001000000000000byte 0byte 1byte 2byte 300010010001101000000000100000000byte 4byte 5byte 6byte 700000000000000010000000000000000byte 8byte 9byte 10byte 1100000000000000000000000000000000id0x1234flags0x0100qdcount1ancount0nscount0arcount0

Summary

The header says this is one recursive query with no answer records yet. Message structure and exact bytes only; resolution timing, caching, and UDP/TCP transport are not modeled here.

header bytes=12\text{header bytes}=12
DNS headerThe DNS query header is decoded from exact bytes.DNS header96 bits / 12 bytes0x123401000001000000000000byte 0byte 1byte 2byte 300010010001101000000000100000000byte 4byte 5byte 6byte 700000000000000010000000000000000byte 8byte 9byte 10byte 1100000000000000000000000000000000id0x1234flags0x0100qdcount1ancount0nscount0arcount0