Ask Your Question
0

DNS query retransmission and query response retransmission

asked 2023-11-20 08:31:31 +0000

bofoh35174 gravatar image

updated 2023-11-20 08:32:56 +0000

I have a DNS capture which has all the query and response being retransmitted, is that normal behavior? for example on the 1st packet:

Packet 1: Query -> [Response In: 3]

Packet 2: [Retransmitted request. Original request in: 1]

Packet 3: [Request In: 1]

Packet 4: [Retransmitted response. Original response in: 3]

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2023-11-20 14:15:48 +0000

Rooster_50 gravatar image

It could be the way you are obtaining your capture. For instance, if you are using port span (port mirror), you could be getting the TX/RX of both the host and the upstream network port.

Look at the ip.id field and compare packet 1 and 2. If they are the same, then Wireshark is being given a duplicate copy of the frame (not a retransmit by your host) possibly due to the configuration of your port span.

It could be due to other circumstances, but sharing a pcap trace would greatly improve the community's chances of assisting you with your question.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2023-11-20 08:31:31 +0000

Seen: 552 times

Last updated: Nov 20 '23