KB186346 - How to Identify Dynamic DNS Frames

Article ID: 186346

Article Last Modified on 11/1/2006

Microsoft Windows 2000 Server
Microsoft Windows 2000 Professional Edition

This article was previously published under Q186346

SUMMARY

Windows 2000 includes the ability for client computers to register Domain Name System (DNS) records automatically with DNS servers configured to accept these updates.

MORE INFORMATION

The following sample captured network frame indicates that the frames are client computer requests to dynamically update the DNS server.

   DNS: 0x1B:Dyn Upd UPD records to MYSERVER.mycorp.com. of type Host Addr
         DNS: Query Identifier = 27 (0x1B)
         DNS: DNS Flags = Query, OpCode - Dyn Upd, RCode - No error
             DNS: 0............... = Request
   -----> DNS: .0101........... = Dynamic Update
             DNS: .....0.......... = Server not authority for domain
             DNS: ......0......... = Message complete
             DNS: .......0........ = Iterative query desired
             DNS: ........0....... = No recursive queries
             DNS: .........000.... = Reserved
             DNS: ............0000 = No error
         DNS: Zone Count = 1 (0x1)
         DNS: Prerequisite Section Entry Count = 0 (0x0)
         DNS: Update Section Entry Count = 3 (0x3)
         DNS: Additional Records Count = 0 (0x0)
         DNS: Update Zone: mycorp.com. of type SOA on class INET addr.
             DNS: Update Zone Name: mycorp.com.
             DNS: Update Zone Type = Start of zone of authority
             DNS: Update Zone Class = Internet address class
         DNS: Update: MYSERVER.mycorp.com. of type Host Addr on class Req.
             for any(2 records present)
             DNS: Resource Record: MYSERVER.mycorp.com. of type Host Addr
             on class Req. for any(2 records present)
                 DNS: Resource Name: MYSERVER.mycorp.com.
                 DNS: Resource Type = Host Address
                 DNS: Resource Class = Request for any class
                 DNS: Time To Live = 0 (0x0)
                 DNS: Resource Data Length = 0 (0x0)

This frame also includes the record to be written:

             DNS: Resource Record: MYSERVER.mycorp.com. of type Host Addr
                  on class INET addr.
                 DNS: Resource Name: MYSERVER.mycorp.com.
                 DNS: Resource Type = Host Address
                 DNS: Resource Class = Internet address class
                 DNS: Time To Live = 1200 (0x4B0)
                 DNS: Resource Data Length = 4 (0x4)
                 DNS: IP address = 100.2.0.3  ---> example IP address

The version of Microsoft Network Monitor included with Windows 2000 Server parses these frames correctly and displays Dynamic DNS update frames.

If you are using a third-party version or an earlier version of Network Monitor, you can identify Dynamic DNS update frames by the four bits in the "DNS Flags" section of the frame, as in the following example:

   DNS: 0x17:Std Qry for mycorp.com. of type SOA on class INET addr.
         DNS: Query Identifier = 23 (0x17)
         DNS: DNS Flags = Query, OpCode - Std Qry, RD Bits Set, RCode - No
              error
             DNS: 0............... = Query
   -----> DNS: .0101........... = Reserved (a value of 5 (0101) here =
             Dynamic DNS Update Record)
             DNS: .....0.......... = Server not authority for domain
             DNS: ......0......... = Message complete
             DNS: .......1........ = Recursive query desired
             DNS: ........0....... = No recursive queries
             DNS: .........000.... = Reserved
             DNS: ............0000 = No error

This frame also includes the record to be written:

         DNS: Authority Section: MYSERVER.mycorp.com. of type Host Addr on
              class INET addr.
             DNS: Resource Name: MYSERVER.mycorp.com.
             DNS: Resource Type = Host Address
             DNS: Resource Class = Internet address class
             DNS: Time To Live = 3600 (0xE10)
             DNS: Resource Data Length = 4 (0x4)
             DNS: IP address = 100.2.0.3   ---> example IP address

NOTE: Specifications for Dynamic DNS are found in Request for Comments (RFC) 2136. For information about obtaining an RFC document, please see the following article in the Microsoft Knowledge Base:

185262 How to Obtain Request for Comments Documents from the Internet

Additional query words: 5.00 ddns query

Keywords: kbhowto kbnetwork KB186346