Original subtitles

What is DNS or domain name system.

In this video I'm going to explain it in a lot of detail but before we get there Alexa N.S. look up

Amazon.com.

The DNS lookout for Amazon dot com is 176 dot 32 dot 103 dot 205.

That is an example of what a DNS does.

It's essentially resolving a name typically a domain name to an IP address.

N S look up a Google dot com DNS look up for Google dot com is 172 dot 217 dot 164 dot 142.

We as humans don't communicate easily using IP addresses.

We use domain names.

So if I told you to go to Google's IP address you probably don't even remember what the IP address was

but you'll remember what Google dot com is so DNS essentially resolves a human readable name such as

Google dot com or Amazon.com to a machine readable IP address.

Machines don't use names they use IP addresses in IP version 4 we use dotted decimal notation IP addresses

such as 1 9 2 1 6 8 wandered 1 IP 6 uses IP addresses such as 2001 colon colon 1 2 3.

There are many IP addresses out there and many Web sites.

It's much easier to remember a domain name once again like Facebook dot com or Amazon.com rather than

the IP address of a server.

And to further complicate it like in my example depending where you're on the world a domain name may

resolve to a different IP address for load balancing.

So if I'm in the UK and I ping Google dot com I may get a different result to you if you in the US or

in Singapore or somewhere else in the world.

It's much easier to remember the domain name than it is to remember an IP address but machines use IP

addresses and traffic is routed across the Internet using IP addresses not names.

DNS is a fundamental building block in networks today without a DNS internet wouldn't really work very

well because very few of us are going to remember IP addresses.

Now as an analogy DNS is like a telephone book taking a name converting it to a telephone number.

But in this case taking a domain name and converting it to an IP address in the bad old days I'd have

to look up someone's number in a book and then I'd have to manually dial their telephone number.

But I don't think any of us do that these days on a phone like an iPhone today we're not going to manually

type a number like this and then dial it we're going to go to our contacts and search for a contact

and then just press on the contact to call the person.

I mean a lot of us probably don't even know our own telephone numbers these days.

We don't know the telephone numbers of other people because we simply look them up in a directory on

our phone.

Now this is a local directory.

We can do something very similar on a P.C. by using what's called a hosts file.

That is the most basic version of so-called DNS.

No it's not DNS but it's a local lookup so you could create your own version of DNS locally on your

P.C. by editing the hosts file.

Taking that a step further companies may have a local DNS server that resolves and names within the

organization but on the public Internet we have distributed DNS systems that allow us to resolve names

such as Google Facebook etc..

Now it's all very good and while talking about DNS but I want to show you practically how it works I'm

going to show you why shock captures I'm going to show you how to setup a DNS server on a Cisco rider.

How to set it up on a country server.

I'll show you basically how you can manipulate a DNS to do anything that you want.

You need to be careful that you use trusted DNS servers.

Don't just trust any DNS server out there.

DNS can be intercepted and you can manipulate the DNS servers used by pieces to get them to go to the

incorrect domain.

Fortunately today a lot of browsers like Chrome have a whole list of certificates preloaded on them

so you'll get a warning if you end up going to an incorrect domain such as Microsoft dot com or Cisco

dot com.

Okay so in this topology I've got a Windows 10 computer it's connected to a Cisco switch which in turn

is connected to a Cisco rather which connects us to the Internet.

This topology is running in Genesis 3.

I'm hosting this entire topology on my computer so forgive me if the fan goes a bit crazy.

It's all running locally on my Mac.

I also have an a bunch too P.C. which will configure as a DNS server.

Okay firstly let's have a look at the Windows computer.

Here's my windows.

P.S. I'll open up a seam deep prompt.

Make this a bit bigger.

IP config shows me that this is the IP address of the P.C. IP version 4 default gateways 10 1 1 2 5

4 and I should at this point be able to paying my default gateway which I can default gateway.

Is this Cisco with IP address once again 10 1 1 2 5 4.

The switch is a lever to switch it's not really doing anything except giving connectivity in the network.

So back on the P.C. IP config slash all shows us that the CPC has to DNS servers configured 8 8 8 8

8 and wandered wandered wandered 1.

In other words Google and CloudFlare are the two DNS servers configured on the P.C. so I'll start a

wire shock capture between the P.C. and the switch so that we can see what's actually going on.

Windows sends a lot of traffic into the network so as you can see here a bunch of traffic is being sent

by that Windows computer out into the network.

But I'm going to filter for DNS and then back on the P.C. what I'll do is ping a domain such as David

Bumble dot com.

And notice we get a reply from this IP address 2 1 7 160 0 sixty nine.

Now the CBO spiking on my P.C. here the throughput through a Cisco switch and a Cisco broad are running

in June 3 may be a bit slow but the point is is that I am getting replies back to that domain and if

we have a look at the Y shock capture what you'll notice is we can see that this IP address 10 1 1 1

cent a DNS request 2 8 8 8 8 8 for domain David Bumble dot com.

So just to confirm on the P.C. once again IP config shows us that this is the IP address of the P.C.

the P.C. send a request to the DNS server notice the query is for David Bumble dot com.

It's a record a record is a domain name in IP version 4 could triple A is a domain name in IP version

6.

So the P.C. is asking the DNS server what the IP address is of the domain name now going back a step

at a layer 2 in the OS model or TTP IP model if you prefer we have Ethernet to.

That's because this network is using ethernet so it's an ethernet connection from the windows P.C. to

the Ethernet switch the source mac addresses the P.C. destination MAC address is the broader basically

the traffic is being switched from the P.C. to the broader because that's how it gets onto the Internet.

So at least to source MAC address will be the P.C. destination MAC address will be the broader but at

least three IP version 4 source IP addresses the P.C. destination IP address is Google.

Now you may notice that this is a RF C 1918 address.

In other words it's a private IP address it's non-refundable.

On the internet but the router is implementing network address translation or Nat.

This is very typical of what your right at home will be doing.

So notice it's enacting this IP address.

Now it is narrowing it to a another ROIC 1918 address but that's because this road is connected to a

cloud which is actually bridging my P.C. physically.

So this P.C. here onto my physical home network and I have an Internet router that runs this onto the

Internet.

So it's actually being nutted multiple times.

But what's important to point out here is notice the protocol at least for each UDP or user data grand

protocol source port number use this 5 2 7 4 9.

That is what's called any femoral or random port number.

Destination Port numbers 53 which is the well-known port number for DNS.

When a server is configured to host multiple services it's got to serve a purpose.

So it's a server that's acting as let's say a file server when you connect to that server it's going

to give you a file.

But when you connect to it using DNS it's listening on Port 53.

If it's being configured as a DNS server so you send traffic to port 53 the server is listening on Port

53 to running an application like which I'll show you in a moment DNS mosque which is a DNS server application

and then it responds back to that to request on the port number that you chose.

So if you connect to a DNS server like this piece is doing you will use a random port number or ephemeral

port number going to a well-known port number and then it'll reply back from that well-known port number

and we can see that here Google is replying from a source port number 53 going to the port number that

the P.C. chose the Windows 10 piece he chose this port number.

The Google DNS server replies back to that port number so again it's UDP destination port number as

a source port number as this.

Digging deeper into the DNS information we can see.

Domain Name System.

It's a query.

It's a standard query for a name.

We're trying to resolve a name the name that we resolving.

Is David Bumble dot com and the DNS server replies back saying this is the answer.

This domain name has this IP address 2 1 7 160 0 69.

So back on our windows P.S. That is the IP address that we see.

So I could copy that IP address go to a web browser.

If I type the domain name it's going to browse to that server.

So I'm able to connect to the domain using the domain name.

And this depends on the server I should be able to connect to the IP address of the server.

In this example I'm getting a form for error.

Now some servers will not allow you to connect directly on the IP address.

That's typically because multiple domains are hosted on a single IP address Okay I'll stop the Y shock

capture and what I want to show you once again is that DNS is essentially just a resolution of name

to IP address and you can do that directly on your Windows computer.

So in windows I'll open up notepad.

I'll run this as an administrator

before I open a file if I pinged brought a 1 notice we told that that domain name is not found the same

with right of one whom dot com the ping request times out.

I can't ping that domain name but what I could do is open a file and what I'm going to do is go to see

Windows system 32 driver's Etsy and I'm going to open the hosts file.

This is a file on the local Windows computer.

Just zoom in there to make it easier to read and I can edit this so I could say 10 1 1 2 5 4 is right

1 and 10 1 1 1 2 5 4 was write a one whom dot com and save that file.

So I'm editing a local file that maps whose names to IP addresses.

So now when I ping wrote a one notice that works when I ping write a one dot home dot com that also

works.

But if I ping wrote it to that fails because it's not in the hosts file and Google is not replying back

with that information.

So if I said or two like this and save that file now ping or two that resolves name got resolved to

an IP address.

Now in this example the networks a bit unstable sort of pings a timing out they had succeeded.

But the important part is the domain name got resolved.

That name got resolved to an IP address.

If I remove these entries from the hosts file and save it

I'll clear the screen there.

When I ping are one now that's going to timeout because I don't have an entry for that domain name.

That's essentially what a DNS server does.

It takes a domain name and maps it to an IP address.