[dns-operations] "NS .", the attack of the month?

[Geoffrey Sisson]

geoff at geoff.co.uk (Geoffrey Sisson) wrote:

> So:
>
> 	(udp[10:2] & 0x8000 = 0)	# QR = 1

And that should be:

 	(udp[10:2] & 0x8000 = 0)	# QR = 0

(Expression was correct, comment was wrong.)

>  	udp[12:2] = 1			# QDCOUNT = 1
>
>  	udp[20] = 0			# QNAME = '.'
>
>  	udp[21:2] = 2			# QTYPE = NS
>
> 	udp[23:2] = 1			# QCLASS = IN