I'm capturing DNS packets in Wireshark and know that 0xc0 indicates a pointer to decode the name or cname as part of the compression format used. I have a DNS reply for res.cdn.office.net and out of 8 answers, the last 3 have 0xc1 instead of 0xc0 and still produce a valid cname. Anyone know what 0xc1 means in a DNS reply in terms of decoding the name?
I hope I've explained that ok :)