Developing a Valid DNS Response

Creating application-layer responses to requests

In a server or honeypot, some response packets will stop at the TCP layer. For example, the TCP handshake’s SYN/ACK packet carries no data.

However, a server or honeypot likely needs to be able to generate legitimate responses to requests at the application layer. For example, requests for an IP address via DNS or a web page via HTTP might need a response.

Examining DNS request packets

DNS traffic is typically carried over UDP, but it can also use TCP or even HTTPS as a transport medium. Unlike a UDP header, defining a valid DNS response requires setting multiple different field values.

To start, let’s take a look at a sample DNS request packet.