-1

In RFC1035, it says that in a DNS response, if the resource data is a pointer then the first two bits of those resource data should be 11. If it is a domain name, they should be 00. Two questions:

  1. What happens in the case the resource data is an IP address, eg 201.1.2.3 where 0d201 = 0b11001001 ? Are there other fields taken into account as well?
  2. Is this distinction between 11 and 00 for the first two bytes really needed? If the resource data length field is taken into account, then wouldn't a length of 2 uniquely identify a pointer in the resource? A domain name cannot be 2 bytes long in the notation used in DNS messages.
2
  • I think this is a bit too deep question on actual network protocols to be suitable for Serverfault. Sep 27, 2016 at 20:27
  • Where do you suggest it should be placed? Sep 27, 2016 at 21:18

2 Answers 2

2

You've misread the RFC.

It states that the two high bits of the length octet shall be set to 11 or 00.

More specifically, if these two bits are 00, the byte is treated as a length, and the lower 6 bits represent the number of bytes following. If the two bits are 11, the field is a pointer, and the following 14 bits represent the offset.

4
  • The length octet is the first octet of the resource data in the case of a domain name and there is no length octet in the case of a pointer. Sep 27, 2016 at 21:20
  • @NikolaosKakouros Now you're starting to understand. It isn't really a length octet at all, when it's a pointer. Sep 27, 2016 at 21:23
  • I might be missing sth. In the example I give with the IP address, how can the client, receiving a response, know that this is an IP and not a pointer? Sep 27, 2016 at 21:29
  • @NikolaosKakouros The two high bits of the length octet will be 00. Sep 27, 2016 at 22:43
0

For question b:

In the resource records inside a DNS response there is a field called "Resource data length". Using this, one could indeed figure out if the resource data is a pointer, a domain name or even a part of a domain name followed by a pointer to the rest of the domain name. However, in the beginning of every resource record, there is also a field that should carry the domain name/IP addr/etc that the client queried for. In this case, the use of the two bits as mentioned in the question is the only way to tell what is contained in this field; a domain name or a pointer.

For question a:

There is a "Domain type" field in the resource records that in the case of a PTR response would denote that the resource data is a 4 (or 16) octet address. No need to check on the first two bits of the resource data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .