LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 08-22-2015, 10:36 PM   #1
luofeiyu
Member
 
Registered: Aug 2015
Posts: 243

Rep: Reputation: Disabled
How to understand the output of tcpdump?


tcpdump host 192.168.1.100
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
11:20:52.789742 IP localhost.37902 > d.root-servers.net.domain: 42429% [1au] DNSKEY? . (28)
11:20:52.789865 IP localhost.41693 > d.root-servers.net.domain: 18942% [1au] NS? . (28)
11:20:52.970349 IP d.root-servers.net.domain > localhost.37902: 42429*- 3/0/1 DNSKEY, DNSKEY, RRSIG (736)
11:20:52.977970 IP d.root-servers.net.domain > localhost.41693: 18942*- 14/0/25 NS h.root-servers.net., NS c.root-servers.net., NS f.root-servers.net., NS g.root-servers.net., NS m.root-servers.net., NS e.root-servers.net., NS k.root-servers.net., NS a.root-servers.net., NS j.root-servers.net., NS l.root-servers.net., NS d.root-servers.net., NS i.root-servers.net., NS b.root-servers.net., RRSIG (913)
11:20:53.262676 IP localhost.11242 > b.root-servers.net.domain: 20749% [1au] DNSKEY? . (28)
11:20:53.262749 IP localhost.58491 > b.root-servers.net.domain: 57315% [1au] NS? . (28)
11:20:53.670548 IP localhost.53771 > public1.alidns.com.domain: 23778+ PTR? 13.91.7.199.in-addr.arpa. (42)


1.what does d.root-servers.net.domain mean?
2.What does public1.alidns.com.domain mean?

ping public1.alidns.com
ping: unknown host public1.alidns.com
 
Old 08-23-2015, 12:47 AM   #2
ericson007
Member
 
Registered: Sep 2004
Location: Japan
Distribution: CentOS 7.1
Posts: 735

Rep: Reputation: 154Reputation: 154
Those are all just dns servers to translate ip adresses and domain names. Root servers are the main servers on the internet. So it is sort of like the boss translator. They are also authorative dns servers. This means that whenever your isp or your own router acting as a dns for your network needs a name, those root servers will be asked and cached in the dns records of the aerver you normally connect to.

The alidns is an intermediate public facing server. Probably the one of your isp, I am not sure about this. It does seem to be a Chinese dns service though.
 
Old 08-23-2015, 07:21 PM   #3
luofeiyu
Member
 
Registered: Aug 2015
Posts: 243

Original Poster
Rep: Reputation: Disabled
ping alidns.com
PING alidns.com (110.75.69.72) 56(84) bytes of data.
64 bytes from 110.75.69.72: icmp_seq=1 ttl=54 time=77.3 ms
64 bytes from 110.75.69.72: icmp_seq=2 ttl=54 time=78.6 ms

whois alidns.com
Registrant Country: CN


ping public1.alidns.com
ping: unknown host public1.alidns.com

What does public1 mean here ?
why can't ping public1.alidns.com ?
 
Old 08-23-2015, 07:46 PM   #4
luofeiyu
Member
 
Registered: Aug 2015
Posts: 243

Original Poster
Rep: Reputation: Disabled
root@pengsir:/home/debian8# ping root-servers.net
ping: unknown host root-servers.net
root@pengsir:/home/debian8# ping root-servers.net.domain
ping: unknown host root-servers.net.domain
root@pengsir:/home/debian8# ping d.root-servers.net.domain
ping: unknown host d.root-servers.net.domain
 
Old 08-23-2015, 07:49 PM   #5
luofeiyu
Member
 
Registered: Aug 2015
Posts: 243

Original Poster
Rep: Reputation: Disabled
ping d.root-servers.net
PING d.root-servers.net (199.7.91.13) 56(84) bytes of data.
64 bytes from d.root-servers.net (199.7.91.13): icmp_seq=1 ttl=52 time=179 ms

I got it!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
tcpdump output ??? bill_nimmo Linux - Networking 4 11-17-2014 10:10 AM
need help to understand tcpdump output tkmsr Linux - Networking 3 03-07-2011 01:47 AM
Does any1 understand the output of tcpdump? deostroll Linux - Networking 8 08-14-2009 07:16 AM
tcpdump output help asim_s2000 Linux - Networking 4 11-11-2004 08:30 AM
tcpdump output hampel Linux - Security 9 07-18-2003 12:53 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 10:29 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration