 | 1 | initial version |
(Looks like the red text is for a different query - "www" vs "www2" in the screen shot)
When all else fails, read the instructions: DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION
3.1. Name space definitions
Domain names in messages are expressed in terms of a sequence of labels.
Each label is represented as a one octet length field followed by that
number of octets. Since every domain name ends with the null label of
the root, a domain name is terminated by a length byte of zero. The
high order two bits of every length octet must be zero, and the
remaining six bits of the length field limit the label to 63 octets or
less.
Wireshark displays [Label Count: 3] for www2, <the long text>, com
The red text should start with \x04www2 to match the screen shot.