Hey guys and welcome back. So now that we've learned the basic steps around the DNS process,
what I now want to focus in on are some basic client tools and client configuration fails
that we would actually use with respect to our DNS settings. So we actually do have a bunch of
different tools with respect to DNS. We have one called NSLookup, we have one called Host,
and we have one called Dig. Now what I will say is that NSLookup, this one is a deprecated command,
it's not one that is currently recommended or used very often anymore. Like I say,
you actually can use it, but it's generally seen to be outdated instead. More likely you are to
use the host command or my favorite one, the dig command. But for the purposes of the examination,
we do want to know what these commands are, how we can use them, as well as some basic
configuration fails we have to know. So how about we dig in and talk about it then shall we?
So what I'll do is I will clear my screen here. Okay, so the first command we're going to look at
is the NSLookup command, we can say man NSLookup. Okay, and we can see here this is going to query
internet name servers interactively. Sounds like something that we want to do. So our DNS servers,
this is what we're going to query. If we go on down, we can see we have some additional options.
Say for example, specifying the timeout, which is going to be the timeout interval as we can see
here, i.e. how long should we actually wait for a particular reply before timing out and abandoning
the request. And this is going to be as we can see here in seconds. Similarly, how many retries
do we want to have. So let's say maybe we timeout, we want to retry the request, we can specify how
many retries before we just give up and say, hey listen, we can't get the information, something
must be wrong. Like I say, if we scroll on up, we have a whole bunch of other information,
we can recurse, we can specify the type of request, we can see here this is something called an A
request and a quadruple A request, we'll talk about what those are very, very shortly. And we can see
here the port number now. Important to note here, the default value is 53. This is a well known port
number for DNS, port number 53. Now this can operate either over UDP or depending on the
particular request, if we're doing things like zone transfers, it would actually use something
called TCP. But like I say, port 53 is the well known port for DNS. The reason why I'm telling you
this is that if you happen to be dealing with your own DNS servers and you happen to have a
firewall in place, you want to be making sure that you can allow traffic across port number 53 to
allow those DNS server requests to go through. But like I say, if you happen to change the
configuration so that your DNS server is not using the well known port of 53, you can actually
send a query via a different port by changing the port value using this option right here. But like
I say, we don't have to do this right now. Just be aware of port 53 and that we can change it if
necessary. It is a default value, but not a mandatory value. So what we'll do here is I will
just quit and we'll actually use this command and see what we get back. So what I'll do is I'll say
nslookup and I will lookup youtube.com. So now we actually get our request. Now we can actually see
here the information comes back as a non authoritative answer. This just means that we didn't get the
answer directly from the authoritative server. We got it somewhere else from within the chain of
requests that happened to be made as part of this request. Now we can see here the actual domain name
youtube.com, which is what we queried up here, quite the thing. And we can see what actually has been
resolved is this IP address. So 142 to 5200 dot 14. This will be the IPv4 address for YouTube. Now
we can also see below for the same domain name we have this funny looking address, but we will know
that this is indeed the IPv6 address, which is a hexadecimal address. But now we actually do have
the information we need to be able to reach youtube.com. In fact, let me just see if I can ping this
server 142 to 50 200 dot 14. And there we are. I'm able to ping the YouTube server, meaning I do have
a reachability to it. Okay, now like I said, the other command we had was the host command. This one
here, as we can see is a DNS lookup utility very much in the same vein as NS lookup, although a
little bit more modern. We can see here we have particular options whereby we can query certain
things such as only query IPv4 information, or we can only query IPv6 information. We can specify
the type of request, will it be TCP or UDP as we can see here by default, we're going to use UDP,
but you can use dash T to initiate a TCP request, and we can control our timeouts using the dash
w key, and that is capital W. This is going to allow us to wait a specific amount of seconds,
just like we saw with the timeout option with respect to NS lookup. So really quite the same.
If we press Q, we can use this one, we'll say host, let's try again, we'll say youtube.com.
And as we can see here, we get the information back, although it is presented a little bit
differently. In fact, the host command probably is the nicest looking format, at least in my opinion.
We don't get any extraneous information, it just gives us this nice readable output. We can see
youtube.com has an IP address 142, 250, 214, we know this, and we can also see the IPv6 address,
which is what we also just saw before with the NS lookup command. And we also see that mail
is handled by smtp.google.com. So some cool information right there. Now the next command
we have to be aware of, like I say, is the dig command. Once again, a DNS lookup utility. We
have a whole bunch of options, which I encourage you to scroll through. There is a lot when it
comes to dig, and what I'll do is I'll just press Q. But in order to be able to use the dig command,
like I say, really quite simple, we just say dig, and then specify the name of the server,
youtube.com, like we did before. As we can see here, the information, a little bit more of our
boss. Now what we're actually seeing here, in the answer section right here, we can see the youtube.com,
and notice we can actually see the dot on the very end. This is what we happened to mention,
what we talked about, the fully qualified domain name, and the previous nuggets. This value right
here happens to be the TTL. Now you may remember, we talked about the TTL when we talked about the
ping command and the trace root command. This was how many hops that were allowed before the ping
request would ultimately die. In this case, the TTL is a little bit different. It's not based on
hops. This is not 101 hops. What we're talking about here is an actual time. So in this case,
right here, this is meaning that this information will be cached for 101 seconds. And we can see
here the actual results here. In fact, let me just not draw over the results. We can see this is
the correct result as we saw with the host command and the NSLookup command. And we can actually see
the type of record. We got back an A record, and we'll talk about that very, very shortly. So cool,
we have all this information right here, as well as a whole bunch of other stuff. We can see the
message size. But again, you don't have to be too concerned about all the details within DIC. This is
a very expansive and very verbose tool. But now that we understand these basic commands, let's look
at some of the configuration files that we can use with respect to our DNS configuration locally.
So check this out then. The first place that I'm going to go to is whereabouts my DNS
servers happen to be. Now this is going to be in the Etsy directory, and it's going to be in a file
called resolve.conf. So if I do an LS, in fact, let me just grab for that. Now we can see here
resolve.conf, and I always try to emphasize that this is resolve without an E in the end.
This file right here is where we can specify where our nameservers actually will be. So I will say
sudo nano because again, we're in the system-wide Etsy directory, so we need super user privileges
if we wanted to modify this file. And I'll go into resolve.conf. So type in my password right here,
and check this out. So what we can see here is the name server right here. This happens to be a
local configuration. But what I could do is I could actually change the name server. So right now,
what I could see here is I could change this to 8.8.8.8 or maybe 8.8.4.4. 8.8.8.8 and 8.8.4.4
are two well-known public Google DNS servers. These are servers operated by Google that the public
can use. So check this out now that I've changed this particular file when I go to make my particular
request, say for example pinggoogle.com. The actual resolution of that request to get this,
let me just stop this just now, to get this actual IP address will actually be coming
from Google's public DNS server. Similarly, if I happen to ping, let's maybe say wikipedia.org,
the actual resolution here to get this IP address is being queried via Google's public DNS server,
as opposed to let's maybe say my own ISP or something, you know. So that would mean that if we
happen to have a server on our local network, how could we actually tell this particular host to
use that server? Well, we know that answer. We would just modify it to resolve.conf and then
put in the name server that happens to be on our local network, whether it may be, I'll just maybe
say it was 192.1680.67 or something. And then our DNS request would go to that particular server.
For now, what I'll do is I'll just put it back to what it was and just save you. Similarly,
remember when I talked about in the very first nugget that we don't actually have to make a
particular request, we can actually map the bindings manually ourselves. Well, we can do this
within our once again, the Etsy directory, but it's going to be in a file called hosts. In fact,
I should actually grip for hosts. So this one right here, let's go into this. So I'll say nano
etsy host. And we can see here, if I happen to just ping local host, i.e. the name local host,
it will actually ping this IP address. If I happen to ping IP six, hyphen local net, it will ping this
IPv6 address. So what I could do is I could actually type in any configuration right here.
I'll just say eight dot eight dot eight dot eight should be resolved to the name random blah,
john IPv0, just some gibberish. Okay. Now, if I save this, in fact, I should actually need to use my
super user privileges, just realized that should have actually been aware of that, of course,
so to do nano, let's try that again. So let's just say I don't know, let's just keep it even simpler,
IPv0, CBTN, whatever it may be, if I save this, so if I just happen to ping IPv0, CBTN,
and hit enter, notice we're actually pinging eight dot eight dot eight dot eight, which happens to be,
like I say, Google's own server. But I've actually changed the mapping right here. Now, of course,
you don't want to do this, i.e. you don't want to be making erroneous mappings mapping the wrong IP
address to the wrong domain name. But if you happen to want to have some static configuration,
i.e you happen to know an IP address, maybe it's an IP address you happen to own yourself,
and you want to map it to a particular domain, saving you from having to do any type of DNS
lookups externally by reaching DNS servers remotely over a network, you can just get that
information directly from this Etsy host configuration file. Now, one thing I will say
is that what we've been doing so far is what is called a forward lookup, a forward DNS lookup.
So like I say, I go and get the IP address of Wikipedia.org, we can see this is the IP address
right here. But let's say we were doing some type of network forensics, for example, and we're doing
packet captures, maybe we're using TCP dump or a tool called Wireshark, and we see a lot of traffic
maybe destined for this particular IP address. And we want to find out maybe a little bit more
information about what this IP address actually is, what it's tied to. Okay, so we can find out the IP
address from the domain name using a forward DNS lookup. But these tools can also do a reverse
DNS lookup IE, we can supply the IP address, and we can get information relating to the domain itself.
So check this out. If I say host, and I take the Wikipedia information right here, like I say,
let's just imagine we happen to see a whole bunch of information destined for this IP address within
the IP packets we are capturing. If I do a reverse DNS lookup, I enter, we can actually get this
pointer information relating back to the domain itself. So understand that we do have these particular
configuration files that we can use to configure our own local DNS settings. And we also have these
tools which we can locally use to find out DNS information as well as troubleshoot DNS information.
And remember we can do a forward DNS lookup as well as a reverse DNS lookup. Okay,
Doc, so I hope this has been informative for you. I'd like to thank you for viewing.