1 1 00:00:00,400 --> 00:00:02,470 Hands-on with DNS. 2 2 00:00:02,470 --> 00:00:04,400 In this video, I'm going to take you a little bit 3 3 00:00:04,400 --> 00:00:06,540 inside of the network and we're going to use a tool 4 4 00:00:06,540 --> 00:00:08,330 called packet tracer from Cisco 5 5 00:00:08,330 --> 00:00:09,950 so we can actually watch the packets 6 6 00:00:09,950 --> 00:00:11,650 and then see exactly what's going to happen 7 7 00:00:11,650 --> 00:00:13,360 as packets go across the network 8 8 00:00:13,360 --> 00:00:14,980 when we do our DNS resolution 9 9 00:00:14,980 --> 00:00:16,990 to be able to pull up a website. 10 10 00:00:16,990 --> 00:00:18,090 When we go in the environment, 11 11 00:00:18,090 --> 00:00:20,567 you can see on my left side, I have a sample network. 12 12 00:00:20,567 --> 00:00:23,210 I have a client and I have a local DNS server, 13 13 00:00:23,210 --> 00:00:25,020 both attached to switch zero, 14 14 00:00:25,020 --> 00:00:27,830 then those attached to that company's router. 15 15 00:00:27,830 --> 00:00:29,810 That company's router has a serial connection, 16 16 00:00:29,810 --> 00:00:32,500 indicated in red, that's connecting to an internet router. 17 17 00:00:32,500 --> 00:00:34,270 And this would usually be shown as a big cloud 18 18 00:00:34,270 --> 00:00:36,000 with a lot of different routers and switches 19 19 00:00:36,000 --> 00:00:38,950 in the real world, because the internet's a big place. 20 20 00:00:38,950 --> 00:00:41,175 But in this case, I'm just going to use one router 21 21 00:00:41,175 --> 00:00:44,010 so I can use that as my sample internet. 22 22 00:00:44,010 --> 00:00:46,400 In that internet router or in that internet cloud, 23 23 00:00:46,400 --> 00:00:48,780 if you will, there's also a DNS server there. 24 24 00:00:48,780 --> 00:00:50,380 This is the root DNS server. 25 25 00:00:50,380 --> 00:00:52,510 So you can think about something like the .com domain 26 26 00:00:52,510 --> 00:00:53,950 or the .net domain. 27 27 00:00:53,950 --> 00:00:55,890 That's what we're talking about here. 28 28 00:00:55,890 --> 00:00:57,330 Now off to the right, you'll see 29 29 00:00:57,330 --> 00:00:58,700 there's the Dion Training router. 30 30 00:00:58,700 --> 00:01:00,430 Now this is our border gateway router 31 31 00:01:00,430 --> 00:01:01,850 that's connected to the internet. 32 32 00:01:01,850 --> 00:01:04,290 So when your company tries to access our company, 33 33 00:01:04,290 --> 00:01:05,610 it goes over the internet and goes 34 34 00:01:05,610 --> 00:01:06,770 from your company's router 35 35 00:01:06,770 --> 00:01:08,050 through a bunch of internet routers 36 36 00:01:08,050 --> 00:01:10,440 and eventually to the Dion Training router. 37 37 00:01:10,440 --> 00:01:12,450 Now the Dion Training router is then connected 38 38 00:01:12,450 --> 00:01:14,680 to our internal switch, known as switch one, 39 39 00:01:14,680 --> 00:01:17,690 and that has two devices hanging off of it that you can see. 40 40 00:01:17,690 --> 00:01:19,240 One is at the bottom of the screen, 41 41 00:01:19,240 --> 00:01:21,720 called authority.diontraining.com. 42 42 00:01:21,720 --> 00:01:23,940 This is our internal DNS server. 43 43 00:01:23,940 --> 00:01:27,040 And then up top, you have server.diontraining.com, 44 44 00:01:27,040 --> 00:01:29,690 which is acting as a web server in this example. 45 45 00:01:29,690 --> 00:01:31,140 All right, the first thing I want to show you 46 46 00:01:31,140 --> 00:01:33,400 is that all of these DNS servers right now 47 47 00:01:33,400 --> 00:01:35,420 have empty caches because I haven't done anything 48 48 00:01:35,420 --> 00:01:36,950 and it's a brand new network. 49 49 00:01:36,950 --> 00:01:39,030 So if I click in here and go to services, 50 50 00:01:39,030 --> 00:01:42,360 you can see under DNS that I have a couple of records here 51 51 00:01:42,360 --> 00:01:44,770 and under my cache it is completely empty. 52 52 00:01:44,770 --> 00:01:45,750 If it had something in there, 53 53 00:01:45,750 --> 00:01:47,960 I could clear the cache from here. 54 54 00:01:47,960 --> 00:01:50,500 Next, we're going to look at the root DNS server, 55 55 00:01:50,500 --> 00:01:52,600 and I'm going to look at its DNS cache as well 56 56 00:01:52,600 --> 00:01:55,205 and see that it is also clear. 57 57 00:01:55,205 --> 00:01:56,780 Finally, I want to look 58 58 00:01:56,780 --> 00:01:59,260 at the Dion Training authority DNS server. 59 59 00:01:59,260 --> 00:02:02,560 And I'm going to look at that and see again that it's clear. 60 60 00:02:02,560 --> 00:02:06,070 All right, so what happens when you, as a client, 61 61 00:02:06,070 --> 00:02:08,410 want to go to Diontraining.com? 62 62 00:02:08,410 --> 00:02:10,390 Well, you're going to go onto your client 63 63 00:02:10,390 --> 00:02:12,450 and you are going to end up hitting desktop 64 64 00:02:12,450 --> 00:02:14,050 and go to your web browser. 65 65 00:02:14,050 --> 00:02:15,340 Just like you would at home, you'd open up 66 66 00:02:15,340 --> 00:02:17,430 Google Chrome or Safari or something like that. 67 67 00:02:17,430 --> 00:02:19,320 And we're just going to type in what we want to go to, 68 68 00:02:19,320 --> 00:02:22,540 in this case, Diontraining.com, and then hit go. 69 69 00:02:22,540 --> 00:02:24,160 Now, because this is a packet tracer 70 70 00:02:24,160 --> 00:02:26,910 I'm going to step-by-step through each and every packet 71 71 00:02:26,910 --> 00:02:28,810 as it moves across the network. 72 72 00:02:28,810 --> 00:02:31,440 You can see when I hit go, two packets showed up, 73 73 00:02:31,440 --> 00:02:34,140 one with that brownish color and one with the green. 74 74 00:02:34,140 --> 00:02:35,600 So what I'm going to do is I'm going to minimize 75 75 00:02:35,600 --> 00:02:37,250 the client right now because it's going to take 76 76 00:02:37,250 --> 00:02:38,930 a lot of packets going back and forth 77 77 00:02:38,930 --> 00:02:41,180 before we actually see anything in this web browser. 78 78 00:02:41,180 --> 00:02:42,940 And I want you to see what I have on the right side 79 79 00:02:42,940 --> 00:02:43,790 of the screen. 80 80 00:02:43,790 --> 00:02:45,800 This is a list of all of the different clients 81 81 00:02:45,800 --> 00:02:47,910 and the different packets going back and forth. 82 82 00:02:47,910 --> 00:02:51,740 So at time 0.0 you can see there was no last device, 83 83 00:02:51,740 --> 00:02:54,320 but the first device here is it is at the client. 84 84 00:02:54,320 --> 00:02:56,060 So it created these new packets. 85 85 00:02:56,060 --> 00:02:58,540 We have a DNS packet and an ARP packet. 86 86 00:02:58,540 --> 00:03:00,210 Now why does this happen? 87 87 00:03:00,210 --> 00:03:02,120 Well, when the client wants to look up something 88 88 00:03:02,120 --> 00:03:03,730 through DNS, what does it do? 89 89 00:03:03,730 --> 00:03:06,370 It first checks it's internal DNS cache. 90 90 00:03:06,370 --> 00:03:10,060 And here we can see that this one has no internal DNS cache, 91 91 00:03:10,060 --> 00:03:11,580 but we do have a DNS server 92 92 00:03:11,580 --> 00:03:14,550 of 10.0.0.3 that we want to go to. 93 93 00:03:14,550 --> 00:03:17,770 Now, our default gateway is 10.0.0.1 94 94 00:03:17,770 --> 00:03:19,300 and this particular client, 95 95 00:03:19,300 --> 00:03:24,140 it has an IP address of 10.0.0.2. 96 96 00:03:24,140 --> 00:03:28,000 So when it says I want to go to Diontraining.com, 97 97 00:03:28,000 --> 00:03:31,090 it's first going to say, hey, I need to look this up in DNS. 98 98 00:03:31,090 --> 00:03:32,730 So I'm going to go to my DNS server, 99 99 00:03:32,730 --> 00:03:35,800 which is shown here as 10.0.0.3, 100 100 00:03:35,800 --> 00:03:38,710 which is this DNS server down at the bottom of the diagram. 101 101 00:03:38,710 --> 00:03:41,000 And you can see here, it's on fast ethernet zero, 102 102 00:03:41,000 --> 00:03:44,830 it's link is up and it's 10.0.0.3/24, 103 103 00:03:44,830 --> 00:03:46,720 which is this particular DNS server. 104 104 00:03:46,720 --> 00:03:49,070 But my client doesn't know where that is yet 105 105 00:03:49,070 --> 00:03:51,720 because it only talks to things using Mac addresses. 106 106 00:03:51,720 --> 00:03:53,820 And since I've never talked to the DNS server before 107 107 00:03:53,820 --> 00:03:55,990 'cause this is a brand new network or just created 108 108 00:03:55,990 --> 00:03:57,330 it doesn't know where to go. 109 109 00:03:57,330 --> 00:03:59,480 So it's going to send out an ARP packet 110 110 00:03:59,480 --> 00:04:01,480 and that's why you see that green ARP packet. 111 111 00:04:01,480 --> 00:04:02,820 Now, as you can expect, 112 112 00:04:02,820 --> 00:04:05,510 that ARP packet is going to go from the Mac address 113 113 00:04:05,510 --> 00:04:10,510 of my client and it's going to go to FF FF FF FF FF FF, 114 114 00:04:11,970 --> 00:04:14,170 which is the broadcast at layer two. 115 115 00:04:14,170 --> 00:04:16,310 So when that packet goes to the switch, 116 116 00:04:16,310 --> 00:04:17,970 which we're going to see here in a second, 117 117 00:04:17,970 --> 00:04:19,300 what is the switch going to do? 118 118 00:04:19,300 --> 00:04:21,740 It's going to broadcast it out to everybody. 119 119 00:04:21,740 --> 00:04:24,500 So we see that art packet going from the client 120 120 00:04:24,500 --> 00:04:25,700 to the switch. 121 121 00:04:25,700 --> 00:04:28,150 Once it gets to the switch, the switch is going to look at it 122 122 00:04:28,150 --> 00:04:32,760 and it's going to say, do I know who FF FF FF FF FF FF is? 123 123 00:04:32,760 --> 00:04:33,900 In this case, they do. 124 124 00:04:33,900 --> 00:04:35,450 It knows that it goes to the broadcast. 125 125 00:04:35,450 --> 00:04:37,770 So it's going to send out every other switch port it has. 126 126 00:04:37,770 --> 00:04:39,867 In this case, it's going to go to the company router 127 127 00:04:39,867 --> 00:04:41,770 and the local DNS server. 128 128 00:04:41,770 --> 00:04:43,060 They're going to receive that. 129 129 00:04:43,060 --> 00:04:45,400 And inside that art packet, they're going to see, 130 130 00:04:45,400 --> 00:04:46,790 hey, is this for me? 131 131 00:04:46,790 --> 00:04:48,720 So if I look at this art packet, 132 132 00:04:48,720 --> 00:04:51,760 you can see the inside of it is asking, 133 133 00:04:51,760 --> 00:04:55,780 do you know where the 10.0.0.3 address is? 134 134 00:04:55,780 --> 00:04:57,670 And it's going to say, yes, I do. 135 135 00:04:57,670 --> 00:04:58,600 I'm that guy. 136 136 00:04:58,600 --> 00:05:00,410 And so local DNS is going to answer up 137 137 00:05:00,410 --> 00:05:01,770 back to the switch and say, 138 138 00:05:01,770 --> 00:05:03,750 I'm the device you're looking for. 139 139 00:05:03,750 --> 00:05:05,760 Now on the company router side, it's going to look at that 140 140 00:05:05,760 --> 00:05:08,380 and go, you're looking for 10.0.0.3. 141 141 00:05:08,380 --> 00:05:09,380 That's not me. 142 142 00:05:09,380 --> 00:05:14,170 I'm a router and I host the 10.0.0.0/24 network, 143 143 00:05:14,170 --> 00:05:16,390 but that means I don't need to take this traffic 144 144 00:05:16,390 --> 00:05:18,830 and pass it outward because in my network. 145 145 00:05:18,830 --> 00:05:20,410 So I'm just going to drop this packet 146 146 00:05:20,410 --> 00:05:22,320 because it's not really meant for me. 147 147 00:05:22,320 --> 00:05:23,830 All right, once we do that, 148 148 00:05:23,830 --> 00:05:25,570 we're going to go to the next packet that happens. 149 149 00:05:25,570 --> 00:05:28,010 This time, the DNS server is going to send the message back 150 150 00:05:28,010 --> 00:05:31,220 to the switch and say, yes, I'm the guy you're looking for. 151 151 00:05:31,220 --> 00:05:33,440 I am 10.0.0.3. 152 152 00:05:33,440 --> 00:05:34,760 And the switch says, okay, 153 153 00:05:34,760 --> 00:05:36,430 let me tell that back to the client. 154 154 00:05:36,430 --> 00:05:38,950 So the client now knows what the Mac address is 155 155 00:05:38,950 --> 00:05:40,860 for that local DNS server, 156 156 00:05:40,860 --> 00:05:44,150 because it reports it inside of that ARP message. 157 157 00:05:44,150 --> 00:05:46,100 Now the client, when it receives that goes, 158 158 00:05:46,100 --> 00:05:49,140 great, now I know who to send my DNS traffic to. 159 159 00:05:49,140 --> 00:05:51,330 So I'm going to create a new DNS message, 160 160 00:05:51,330 --> 00:05:52,670 which you can see here in brown, 161 161 00:05:52,670 --> 00:05:55,010 and I'm going to send that back to the switch 162 162 00:05:55,010 --> 00:05:57,510 and the switch is going to send it to the DNS server, 163 163 00:05:57,510 --> 00:05:59,060 because it knows that Mac address 164 164 00:05:59,060 --> 00:06:02,020 was addressed from the client to the DNS server. 165 165 00:06:02,020 --> 00:06:04,330 At this point, the DNS server looks at it 166 166 00:06:04,330 --> 00:06:06,700 and it has to see what do I do with this message? 167 167 00:06:06,700 --> 00:06:07,990 So the first thing we're going to do 168 168 00:06:07,990 --> 00:06:09,840 when we look at that message is we have to check 169 169 00:06:09,840 --> 00:06:11,390 our own DNS records. 170 170 00:06:11,390 --> 00:06:14,140 So as the DNS server, when I see that 171 171 00:06:14,140 --> 00:06:17,910 I'm going to say, do I know what to do with Diontraining.com? 172 172 00:06:17,910 --> 00:06:20,290 So I check my DNS records and here they are. 173 173 00:06:20,290 --> 00:06:21,410 I have two records. 174 174 00:06:21,410 --> 00:06:23,990 I have one for com and one for root. 175 175 00:06:23,990 --> 00:06:27,430 Now the com one is a name server for the .com domain. 176 176 00:06:27,430 --> 00:06:30,120 And it says, if you get something that ends in com, 177 177 00:06:30,120 --> 00:06:32,780 go to the route server here on the right. 178 178 00:06:32,780 --> 00:06:34,520 Well, that then looks in the record, says, 179 179 00:06:34,520 --> 00:06:36,100 okay, where is the root server? 180 180 00:06:36,100 --> 00:06:39,710 I have an A record for that and it's 10.2.0.2. 181 181 00:06:39,710 --> 00:06:41,570 So where is that device? 182 182 00:06:41,570 --> 00:06:43,040 Well, it's not on this network 183 183 00:06:43,040 --> 00:06:44,980 because that's a different local area network. 184 184 00:06:44,980 --> 00:06:47,370 So I'm going to have to send this message to my gateway, 185 185 00:06:47,370 --> 00:06:48,630 which is the company router, 186 186 00:06:48,630 --> 00:06:49,810 which will then forward it out 187 187 00:06:49,810 --> 00:06:53,080 to the appropriate network where 10.2.0.2 is. 188 188 00:06:53,080 --> 00:06:55,300 Now 10.2.0.2 in this example 189 189 00:06:55,300 --> 00:06:58,200 is simulating the top level domain for.com 190 190 00:06:58,200 --> 00:06:59,580 because we don't own this name 191 191 00:06:59,580 --> 00:07:00,690 and we don't know where it goes. 192 192 00:07:00,690 --> 00:07:02,940 So we're going to go to .com and ask them 193 193 00:07:02,940 --> 00:07:04,750 for the authoritative name server for it. 194 194 00:07:04,750 --> 00:07:07,770 Alright, 10.2.0.2 is actually going to be 195 195 00:07:07,770 --> 00:07:09,840 this root DNS server right here. 196 196 00:07:09,840 --> 00:07:13,310 And you can see right here, it is 10.2.0.2/24, 197 197 00:07:13,310 --> 00:07:14,950 and it is up and available. 198 198 00:07:14,950 --> 00:07:18,085 So we want to get that message over to this server 199 199 00:07:18,085 --> 00:07:20,980 and then we're going to check our DNS records on this server. 200 200 00:07:20,980 --> 00:07:22,760 So you're going to watch that brown packet, 201 201 00:07:22,760 --> 00:07:24,640 and it's going to go up to the switch. 202 202 00:07:24,640 --> 00:07:27,020 And the switch is then going to send an ARP message 203 203 00:07:27,020 --> 00:07:29,160 out to the company and out to the client, 204 204 00:07:29,160 --> 00:07:32,570 because again, nobody knows where 10.2.0.2 is yet. 205 205 00:07:32,570 --> 00:07:33,720 Now when it gets to the client, 206 206 00:07:33,720 --> 00:07:36,430 the client says that's not me and drops the message. 207 207 00:07:36,430 --> 00:07:38,860 The router on the other hand says, hey, 208 208 00:07:38,860 --> 00:07:41,570 I know how to get to 10.2.0.2. 209 209 00:07:41,570 --> 00:07:44,630 So I'll answer up for that and say any local area traffic 210 210 00:07:44,630 --> 00:07:46,950 that's destined for that address comes to me 211 211 00:07:46,950 --> 00:07:49,670 and then I'll forward it using layer three IP addresses 212 212 00:07:49,670 --> 00:07:51,540 out to the internet to get it over there. 213 213 00:07:51,540 --> 00:07:53,700 So it's going to send that message back to the switch 214 214 00:07:53,700 --> 00:07:55,900 and the switch sees it, and then it sends it back 215 215 00:07:55,900 --> 00:07:57,410 to the local DNS server. 216 216 00:07:57,410 --> 00:07:58,970 The local DNS server says, great, 217 217 00:07:58,970 --> 00:08:00,310 now I know how to get there. 218 218 00:08:00,310 --> 00:08:03,600 I'm going to send all those requests for 10.2.0.2 219 219 00:08:03,600 --> 00:08:06,470 over to the company router, which is my default gateway. 220 220 00:08:06,470 --> 00:08:07,850 So that's what's going to happen. 221 221 00:08:07,850 --> 00:08:09,010 We see that go up. 222 222 00:08:09,010 --> 00:08:10,110 We see it hit the switch, 223 223 00:08:10,110 --> 00:08:12,400 and then it goes from the switch over to the company. 224 224 00:08:12,400 --> 00:08:14,390 Now, once it gets to the company router, 225 225 00:08:14,390 --> 00:08:18,150 we need to get that over to the 10.2.0.2 device. 226 226 00:08:18,150 --> 00:08:21,340 So it's going to look at it and say, not part of my network. 227 227 00:08:21,340 --> 00:08:24,000 Let me send it out my default gateway to the internet. 228 228 00:08:24,000 --> 00:08:26,730 So it does that and sends it over to the ISP's router. 229 229 00:08:26,730 --> 00:08:28,370 The ISP's looks at and goes, 230 230 00:08:28,370 --> 00:08:30,430 Hmm, where is this thing located? 231 231 00:08:30,430 --> 00:08:31,750 And in this case, we have it 232 232 00:08:31,750 --> 00:08:33,420 directly attached to that router. 233 233 00:08:33,420 --> 00:08:36,000 So it's going to drop that DNS packet 234 234 00:08:36,000 --> 00:08:37,730 and it's going to change it into an ARP packet, 235 235 00:08:37,730 --> 00:08:40,360 'cause again, we always send things to the final device 236 236 00:08:40,360 --> 00:08:42,470 using layer two, using ethernet, 237 237 00:08:42,470 --> 00:08:44,350 and that's going to require a Mac address. 238 238 00:08:44,350 --> 00:08:45,340 And so we have to use our ARP 239 239 00:08:45,340 --> 00:08:47,870 to do the IP and Mac address binding. 240 240 00:08:47,870 --> 00:08:50,970 So the internet routers then can go down to the DNS server. 241 241 00:08:50,970 --> 00:08:52,710 When it hits there the DNS server says, 242 242 00:08:52,710 --> 00:08:54,250 oh, I know what that is. 243 243 00:08:54,250 --> 00:08:56,540 That's me, I'm 10.2.0.2. 244 244 00:08:56,540 --> 00:08:58,930 So it sends that message back to the internet router 245 245 00:08:58,930 --> 00:09:00,900 and the internet router is going to send that message 246 246 00:09:00,900 --> 00:09:02,950 back over to the company, and in turn, 247 247 00:09:02,950 --> 00:09:05,250 they're going to say, okay, I know how to get there. 248 248 00:09:05,250 --> 00:09:07,340 Now at this point, the local DNS server 249 249 00:09:07,340 --> 00:09:09,800 hasn't gotten its message over to that final server yet. 250 250 00:09:09,800 --> 00:09:12,460 And it's going to then send it again to the company. 251 251 00:09:12,460 --> 00:09:15,030 So in this case, it sends it up to the switch zero, 252 252 00:09:15,030 --> 00:09:17,440 from switch zero to company, and now at this point, 253 253 00:09:17,440 --> 00:09:19,360 the company router knows what to do with it. 254 254 00:09:19,360 --> 00:09:21,210 It sends it over to the internet router 255 255 00:09:21,210 --> 00:09:23,290 and the internet router knows what to do with it as well. 256 256 00:09:23,290 --> 00:09:25,960 It's going to send it down to the root DNS server. 257 257 00:09:25,960 --> 00:09:28,540 So we're now going to look at that message, which says, 258 258 00:09:28,540 --> 00:09:33,540 hey, where is this address for www.Diontraining.com 259 259 00:09:33,680 --> 00:09:36,830 or Diontraining.com, like we entered in the browser. 260 260 00:09:36,830 --> 00:09:39,390 Now we're going to look at our DNS records on this server 261 261 00:09:39,390 --> 00:09:41,030 and see if we have one for it. 262 262 00:09:41,030 --> 00:09:43,470 So as we go here and we look at our DNS records, 263 263 00:09:43,470 --> 00:09:45,800 we can see there's nothing in its cache. 264 264 00:09:45,800 --> 00:09:48,070 And we see three records. 265 265 00:09:48,070 --> 00:09:51,370 First we have an SOA record, or a start of authority. 266 266 00:09:51,370 --> 00:09:52,970 Now the start of authority record 267 267 00:09:52,970 --> 00:09:54,820 is going to have these things about it, 268 268 00:09:54,820 --> 00:09:57,410 like saying, when does it expire, when does it refresh, 269 269 00:09:57,410 --> 00:09:59,810 when do you want to retry, what's the minimum time to live 270 270 00:09:59,810 --> 00:10:01,310 and all those details. 271 271 00:10:01,310 --> 00:10:05,440 Now this authority record says who owns the authority name. 272 272 00:10:05,440 --> 00:10:08,017 Now the next one we have is authority.diontraining.com. 273 273 00:10:08,017 --> 00:10:10,000 And we have an A record associated with that, 274 274 00:10:10,000 --> 00:10:13,200 which says this address of authority.diontraining.com 275 275 00:10:13,200 --> 00:10:15,510 goes to 10.4.0.2. 276 276 00:10:15,510 --> 00:10:17,870 That is not the same as diontraining.com. 277 277 00:10:17,870 --> 00:10:21,290 It's not the same as www.diontraining.com. 278 278 00:10:21,290 --> 00:10:23,610 This is a sub domain called authority. 279 279 00:10:23,610 --> 00:10:25,370 And so authority.diontraining.com 280 280 00:10:25,370 --> 00:10:27,310 would be at that server's IP. 281 281 00:10:27,310 --> 00:10:28,550 Now, if we go to the last thing, 282 282 00:10:28,550 --> 00:10:31,170 we do see that there's Diontraining.com there, 283 283 00:10:31,170 --> 00:10:33,370 and this is actually a name server record. 284 284 00:10:33,370 --> 00:10:37,240 So who owns all of the Diontraining.com name server records? 285 285 00:10:37,240 --> 00:10:39,340 Well, it's owned by what we see on the right, 286 286 00:10:39,340 --> 00:10:41,840 which is authority.diontraining.com. 287 287 00:10:41,840 --> 00:10:45,283 So if somebody wants to look up beta.diontraining.com, 288 288 00:10:45,283 --> 00:10:49,570 wwww.diontraining.com, support.diontraining.com, 289 289 00:10:49,570 --> 00:10:52,250 they're going to go from this record to that name server 290 290 00:10:52,250 --> 00:10:54,530 at diontraining.com, which is located 291 291 00:10:54,530 --> 00:10:56,300 at the authority.diontraining.com 292 292 00:10:56,300 --> 00:10:58,820 or 10.4.0.2. 293 293 00:10:58,820 --> 00:11:02,980 So let's look and see, where is 10.4.0.2 on this diagram? 294 294 00:11:02,980 --> 00:11:03,950 Well, here it is. 295 295 00:11:03,950 --> 00:11:06,300 It's authority.diontraining.com, 296 296 00:11:06,300 --> 00:11:08,600 and you can see it's 10.4.0.2. 297 297 00:11:08,600 --> 00:11:12,140 So again, this root DNS server is now going to send the traffic 298 298 00:11:12,140 --> 00:11:14,040 over there and to do that, 299 299 00:11:14,040 --> 00:11:15,770 it's going to have to do that at layer three. 300 300 00:11:15,770 --> 00:11:16,860 So first we're going to have to go 301 301 00:11:16,860 --> 00:11:18,350 through the ARP process again, 302 302 00:11:18,350 --> 00:11:19,910 because we just found a new IP address 303 303 00:11:19,910 --> 00:11:21,360 that nobody knew of before 304 304 00:11:21,360 --> 00:11:23,470 and we have to figure out where it's going to be located. 305 305 00:11:23,470 --> 00:11:25,890 So up we go with the DNS to the internet router, 306 306 00:11:25,890 --> 00:11:27,790 and then that's going to get sent over to the next router, 307 307 00:11:27,790 --> 00:11:29,700 which is Diontraining.com. 308 308 00:11:29,700 --> 00:11:32,320 Now, once it's there, it's now going to have to get delivered 309 309 00:11:32,320 --> 00:11:34,370 that final leg to that server. 310 310 00:11:34,370 --> 00:11:36,580 And this is where we have to again use ARP. 311 311 00:11:36,580 --> 00:11:38,830 So the router is going to drop that message 312 312 00:11:38,830 --> 00:11:40,240 because it doesn't know what to do with it, 313 313 00:11:40,240 --> 00:11:41,660 and instead it's going to start sending out 314 314 00:11:41,660 --> 00:11:43,140 the ARP broadcast again. 315 315 00:11:43,140 --> 00:11:45,230 So out goes the broadcast to the switch, 316 316 00:11:45,230 --> 00:11:46,730 the switch then broadcasts it up. 317 317 00:11:46,730 --> 00:11:48,670 And it goes to server.Diontraining.com, 318 318 00:11:48,670 --> 00:11:51,500 which is my web server and authority.diontraining.com, 319 319 00:11:51,500 --> 00:11:53,000 which is my name server. 320 320 00:11:53,000 --> 00:11:56,160 Now in this case, we were looking for 10.4.0.2, 321 321 00:11:56,160 --> 00:11:59,280 which happened to be the authority.diontraining.com server, 322 322 00:11:59,280 --> 00:12:03,140 so server.diontraining.com is going to drop that ARP packet 323 323 00:12:03,140 --> 00:12:05,760 and not respond to it because it's not meant for them. 324 324 00:12:05,760 --> 00:12:07,760 Instead, the DNS server is going to respond 325 325 00:12:07,760 --> 00:12:10,350 back to the switch and say, I'm who you're looking for. 326 326 00:12:10,350 --> 00:12:12,110 And the switch is going to send that back to the router 327 327 00:12:12,110 --> 00:12:13,670 at Dion Training. 328 328 00:12:13,670 --> 00:12:15,800 Now the Dion Training router knows 329 329 00:12:15,800 --> 00:12:18,260 where the authority.Diontraining.com server is, 330 330 00:12:18,260 --> 00:12:20,730 and it knows how to address it using its Mac address 331 331 00:12:20,730 --> 00:12:22,640 because we just did this ARP broadcast. 332 332 00:12:22,640 --> 00:12:26,810 So the next time we get the retransmit of that DNS request, 333 333 00:12:26,810 --> 00:12:28,240 it's going to go and it's going to come 334 334 00:12:28,240 --> 00:12:30,230 from the client to the switch. 335 335 00:12:30,230 --> 00:12:31,980 The switch says, I know what to do with that. 336 336 00:12:31,980 --> 00:12:33,173 I'm going to send it over to the DNS server 337 337 00:12:33,173 --> 00:12:36,140 because I always use my local DNS server first. 338 338 00:12:36,140 --> 00:12:38,780 Now my local DNS server is going to check its cache. 339 339 00:12:38,780 --> 00:12:40,950 Again, do we have anything in our cache yet? 340 340 00:12:40,950 --> 00:12:42,340 Let's take a look. 341 341 00:12:42,340 --> 00:12:44,610 Right now we don't, because we never got a message 342 342 00:12:44,610 --> 00:12:45,910 back to this server yet 343 343 00:12:45,910 --> 00:12:47,870 to know where the final destination is. 344 344 00:12:47,870 --> 00:12:49,320 So what is it going to do? 345 345 00:12:49,320 --> 00:12:51,040 If it's not my cache, I'm going to send it 346 346 00:12:51,040 --> 00:12:52,520 to the next higher DNS server, 347 347 00:12:52,520 --> 00:12:54,320 which happens to be the root DNS server. 348 348 00:12:54,320 --> 00:12:55,700 So off it goes. 349 349 00:12:55,700 --> 00:12:57,540 It transfers it up to the switch, 350 350 00:12:57,540 --> 00:12:58,890 over to the company router. 351 351 00:12:58,890 --> 00:13:01,140 That's going to say and take it over to the internet. 352 352 00:13:01,140 --> 00:13:04,090 The internet's going to deliver it down to the root DNS server. 353 353 00:13:04,090 --> 00:13:06,630 So the root DNS server is now I'm going to send that message 354 354 00:13:06,630 --> 00:13:07,750 up to the internet router. 355 355 00:13:07,750 --> 00:13:10,370 The internet router is going to send it over to Dion Training 356 356 00:13:10,370 --> 00:13:13,200 and then Dion Training is going to send it over to the switch. 357 357 00:13:13,200 --> 00:13:14,520 The switch knows where to send it now 358 358 00:13:14,520 --> 00:13:16,420 because of that ARP broadcast we just did. 359 359 00:13:16,420 --> 00:13:17,530 And so it's going to send it down 360 360 00:13:17,530 --> 00:13:19,820 to the authority.diontraining.com. 361 361 00:13:19,820 --> 00:13:22,410 Everything we did so far was just to establish 362 362 00:13:22,410 --> 00:13:25,520 that initial connection and get that first DNS request 363 363 00:13:25,520 --> 00:13:26,700 over to the name server, 364 364 00:13:26,700 --> 00:13:29,870 who is the authority for this Diontraining.com name. 365 365 00:13:29,870 --> 00:13:33,130 So now that we're there, what is this server going to do? 366 366 00:13:33,130 --> 00:13:34,120 It's going to take it, 367 367 00:13:34,120 --> 00:13:36,210 and it looks at the request and the request said, 368 368 00:13:36,210 --> 00:13:38,490 I want to know where Diontraining.com is. 369 369 00:13:38,490 --> 00:13:40,500 So it's going to check its DNS records, 370 370 00:13:40,500 --> 00:13:43,020 and in its DNS records, does it have an A record 371 371 00:13:43,020 --> 00:13:45,240 for Diontraining.com or a C name record 372 372 00:13:45,240 --> 00:13:46,630 for Diontraining.com? 373 373 00:13:46,630 --> 00:13:47,990 Well, yes it does. 374 374 00:13:47,990 --> 00:13:50,970 You can see that record number two is Diontraining.com 375 375 00:13:50,970 --> 00:13:54,680 and it's an A record that points to 10.4.0.3. 376 376 00:13:54,680 --> 00:13:57,130 Now that same IP address is also going to be used 377 377 00:13:57,130 --> 00:13:59,120 for server.Diontraining.com. 378 378 00:13:59,120 --> 00:14:00,520 And there's an A record for that. 379 379 00:14:00,520 --> 00:14:02,850 And then finally, you see a C name record at the end, 380 380 00:14:02,850 --> 00:14:05,570 which says www.Diontraining.com, 381 381 00:14:05,570 --> 00:14:09,030 and that is going to be pointing to server.Diontraining.com. 382 382 00:14:09,030 --> 00:14:10,990 So if I went in my web browser and asked 383 383 00:14:10,990 --> 00:14:13,370 for www.Diontraining.com, 384 384 00:14:13,370 --> 00:14:15,080 it's going to use the C name record 385 385 00:14:15,080 --> 00:14:17,630 and point me to server.Diontraining.com, 386 386 00:14:17,630 --> 00:14:19,470 which points me to this A record, 387 387 00:14:19,470 --> 00:14:20,997 which points me to this IP address. 388 388 00:14:20,997 --> 00:14:23,130 And you can see how these things linked together, 389 389 00:14:23,130 --> 00:14:24,390 but when I typed it in, 390 390 00:14:24,390 --> 00:14:26,870 I just typed in directly Diontraining.com. 391 391 00:14:26,870 --> 00:14:29,360 So I'm only going to be looking at record number two here, 392 392 00:14:29,360 --> 00:14:32,200 which is the A record with the IP address we want to go to. 393 393 00:14:32,200 --> 00:14:35,290 So the question is where is 10.4.0.3? 394 394 00:14:35,290 --> 00:14:36,700 Well, if we look at that, 395 395 00:14:36,700 --> 00:14:39,400 it's up here and it's server.Diontraining.com. 396 396 00:14:39,400 --> 00:14:41,250 So now what we want to happen 397 397 00:14:41,250 --> 00:14:44,120 is once the client finds out where the server is located, 398 398 00:14:44,120 --> 00:14:45,620 it's going to start sending all this traffic 399 399 00:14:45,620 --> 00:14:48,600 to the IP address of server.diontraining.com. 400 400 00:14:48,600 --> 00:14:50,670 And we're going to go from the client to the switch 401 401 00:14:50,670 --> 00:14:52,680 across the network, to the other switch, 402 402 00:14:52,680 --> 00:14:55,210 and then up to server.Diontraining.com. 403 403 00:14:55,210 --> 00:14:57,970 So let's see what happens as this DNS message goes back. 404 404 00:14:57,970 --> 00:14:59,540 So it's going to go back to the switch. 405 405 00:14:59,540 --> 00:15:00,670 It's going to give the reply and say, 406 406 00:15:00,670 --> 00:15:02,560 here's the IP address you were looking for. 407 407 00:15:02,560 --> 00:15:04,970 Then it's going to go over to the Dion Training router. 408 408 00:15:04,970 --> 00:15:06,360 From the Dion Training router it's going to go 409 409 00:15:06,360 --> 00:15:07,750 back to the internet router, 410 410 00:15:07,750 --> 00:15:11,140 and now it's going to send it back to the root DNS server, 411 411 00:15:11,140 --> 00:15:13,230 because we want them, that lower level server, 412 412 00:15:13,230 --> 00:15:15,810 to know where is Diontraining.com 413 413 00:15:15,810 --> 00:15:17,530 so if anybody else asks in the future, 414 414 00:15:17,530 --> 00:15:19,070 they can just tell them where it is 415 415 00:15:19,070 --> 00:15:20,850 using that .com domain name 416 416 00:15:20,850 --> 00:15:22,070 instead of having to go all the way back 417 417 00:15:22,070 --> 00:15:24,070 to my individual DNS server. 418 418 00:15:24,070 --> 00:15:25,790 So when I do this, you're going to see 419 419 00:15:25,790 --> 00:15:27,550 that we're going to actually get a cache 420 420 00:15:27,550 --> 00:15:29,600 happening inside this root DNS server. 421 421 00:15:29,600 --> 00:15:30,433 So there we go. 422 422 00:15:30,433 --> 00:15:32,950 Now we've got the root DNS server and it knows where it is. 423 423 00:15:32,950 --> 00:15:35,800 So if I go to services and look at my DNS cache, 424 424 00:15:35,800 --> 00:15:39,210 you're going to see that it now knows that there's an A record 425 425 00:15:39,210 --> 00:15:42,300 for Diontraining.com at this timestamp, 426 426 00:15:42,300 --> 00:15:44,113 and it's going to be going to 10.4.0.3. 427 427 00:15:45,030 --> 00:15:48,290 Now, depending on the time to live for this DNS record, 428 428 00:15:48,290 --> 00:15:49,740 it's going to stay in this cache. 429 429 00:15:49,740 --> 00:15:52,600 And then once that cash is going to expire, 430 430 00:15:52,600 --> 00:15:55,310 it's going to go back and ask again directly from the server 431 431 00:15:55,310 --> 00:15:57,740 instead of using its cache in the future. 432 432 00:15:57,740 --> 00:15:59,150 All right, once we have that, 433 433 00:15:59,150 --> 00:16:01,760 you can see though it did not add that as an A record 434 434 00:16:01,760 --> 00:16:03,350 in its DNS. 435 435 00:16:03,350 --> 00:16:05,570 The reason for this is that this A record 436 436 00:16:05,570 --> 00:16:07,710 is not owned by this root server. 437 437 00:16:07,710 --> 00:16:09,970 It's owned by the authoritative name server, 438 438 00:16:09,970 --> 00:16:11,710 authority.Diontraining.com 439 439 00:16:11,710 --> 00:16:13,530 over on the right side of our screen. 440 440 00:16:13,530 --> 00:16:14,820 So it only can cache it. 441 441 00:16:14,820 --> 00:16:17,190 It can't add the A record automatically. 442 442 00:16:17,190 --> 00:16:19,030 All right, once it gets that we still need to go 443 443 00:16:19,030 --> 00:16:21,460 and tell the lower level DNS server what's going on. 444 444 00:16:21,460 --> 00:16:23,120 So it's now going to send a message 445 445 00:16:23,120 --> 00:16:25,830 up to the internet router, over to the company router, 446 446 00:16:25,830 --> 00:16:27,460 which sends it over to the switch. 447 447 00:16:27,460 --> 00:16:28,770 The switch knows where it needs to go. 448 448 00:16:28,770 --> 00:16:31,040 So it sends it down to the local DNS server. 449 449 00:16:31,040 --> 00:16:33,307 And now if we check the local DNS server, 450 450 00:16:33,307 --> 00:16:35,250 we're going to see that its cache 451 451 00:16:35,250 --> 00:16:37,057 now has that same A record in it. 452 452 00:16:37,057 --> 00:16:39,570 And so, again, we didn't add it as an A record here. 453 453 00:16:39,570 --> 00:16:41,560 We added it as a cache, 454 454 00:16:41,560 --> 00:16:43,751 and you can see now that we now have the cache name 455 455 00:16:43,751 --> 00:16:45,823 for the name server on the way over, 456 456 00:16:45,823 --> 00:16:48,230 and now we have the cash name for the IP address 457 457 00:16:48,230 --> 00:16:50,260 for Diontraining.com. 458 458 00:16:50,260 --> 00:16:52,790 So at this point our local DNS server 459 459 00:16:52,790 --> 00:16:54,550 can now interrupt for anybody 460 460 00:16:54,550 --> 00:16:56,520 who's asking where Diontraining.com is, 461 461 00:16:56,520 --> 00:16:58,380 and we don't have to go through all those packets 462 462 00:16:58,380 --> 00:17:00,710 we just did to get that information again, 463 463 00:17:00,710 --> 00:17:02,140 because we already have it. 464 464 00:17:02,140 --> 00:17:03,970 Now once the time to expire happens, 465 465 00:17:03,970 --> 00:17:05,860 we're going to have to have that cache invalidated 466 466 00:17:05,860 --> 00:17:07,240 and it happens automatically. 467 467 00:17:07,240 --> 00:17:09,290 So then we would have to go all the way back to the server 468 468 00:17:09,290 --> 00:17:12,050 and get a new copy because maybe I changed my IP address 469 469 00:17:12,050 --> 00:17:13,470 or move that server. 470 470 00:17:13,470 --> 00:17:15,530 All right, so now that the DNS server has it, 471 471 00:17:15,530 --> 00:17:17,730 it can answer that back to the original requester, 472 472 00:17:17,730 --> 00:17:19,490 which was our client. 473 473 00:17:19,490 --> 00:17:21,920 So now our client knows where to go. 474 474 00:17:21,920 --> 00:17:24,557 So now the client can actually start sending traffic 475 475 00:17:24,557 --> 00:17:27,320 and we want to send on HTTP traffic 476 476 00:17:27,320 --> 00:17:30,200 because that's what we were trying to do by going to a website. 477 477 00:17:30,200 --> 00:17:31,970 Now first, you're seeing this ARP again. 478 478 00:17:31,970 --> 00:17:33,570 This ARP is going to the switch, 479 479 00:17:33,570 --> 00:17:35,350 and then that's going over to the company 480 480 00:17:35,350 --> 00:17:37,620 and the DNS server, because we now know 481 481 00:17:37,620 --> 00:17:39,480 what the IP address we want to go to is. 482 482 00:17:39,480 --> 00:17:41,260 And that IP address was the IP address 483 483 00:17:41,260 --> 00:17:43,080 for server.Diontraining.com. 484 484 00:17:43,080 --> 00:17:45,050 But our switch doesn't know that 485 485 00:17:45,050 --> 00:17:46,460 and our router doesn't know that. 486 486 00:17:46,460 --> 00:17:48,810 So we again have to ARP to say, hey, 487 487 00:17:48,810 --> 00:17:51,830 what is the Mac address for this IP address? 488 488 00:17:51,830 --> 00:17:53,080 Both these things are going to get it. 489 489 00:17:53,080 --> 00:17:55,210 And both of them are going to say, it's not me. 490 490 00:17:55,210 --> 00:17:57,090 The company router on the other hand is going to say, 491 491 00:17:57,090 --> 00:17:59,810 it's not me, but I know where to send it 492 492 00:17:59,810 --> 00:18:01,310 so you can send that to me 493 493 00:18:01,310 --> 00:18:03,230 and I'll send it out my default gateway. 494 494 00:18:03,230 --> 00:18:04,180 So that's what's going to happen. 495 495 00:18:04,180 --> 00:18:06,240 We get that ARP request going back to the switch. 496 496 00:18:06,240 --> 00:18:08,780 The switch now knows anytime somebody's asking 497 497 00:18:08,780 --> 00:18:11,110 for that server.Diontraining.com IP 498 498 00:18:11,110 --> 00:18:12,190 that we were talking about, 499 499 00:18:12,190 --> 00:18:14,050 it's going to go over to the company router 500 500 00:18:14,050 --> 00:18:16,490 because that is considered the default gateway. 501 501 00:18:16,490 --> 00:18:17,670 All right, now that we see that, 502 502 00:18:17,670 --> 00:18:19,330 what's the next thing that's going to happen? 503 503 00:18:19,330 --> 00:18:21,660 Well, the Dion Training router is also going to be doing 504 504 00:18:21,660 --> 00:18:23,550 an ARP request on its side of the connection, 505 505 00:18:23,550 --> 00:18:25,810 because it needs to know how to do that final delivery 506 506 00:18:25,810 --> 00:18:26,770 to that server. 507 507 00:18:26,770 --> 00:18:28,260 So it's doing an ARP broadcast. 508 508 00:18:28,260 --> 00:18:29,560 It goes out to the switch, 509 509 00:18:29,560 --> 00:18:31,360 the switch sends it to both the servers. 510 510 00:18:31,360 --> 00:18:32,630 And then the one that it is, 511 511 00:18:32,630 --> 00:18:34,190 is going to respond back to the switch, 512 512 00:18:34,190 --> 00:18:37,370 in this case, server.Diontraining.com. 513 513 00:18:37,370 --> 00:18:38,550 Now, as we do that, 514 514 00:18:38,550 --> 00:18:39,900 the switch now gets that message 515 515 00:18:39,900 --> 00:18:42,100 and it sends it back to Dion Training using ARP 516 516 00:18:42,100 --> 00:18:44,720 to say, hey, I know where to send messages 517 517 00:18:44,720 --> 00:18:46,730 for the server.Diontraining.com, 518 518 00:18:46,730 --> 00:18:48,210 so go ahead and send it to me as a switch 519 519 00:18:48,210 --> 00:18:50,580 and I'll deliver it on the local area network. 520 520 00:18:50,580 --> 00:18:52,400 All right, so now that we did all of that, 521 521 00:18:52,400 --> 00:18:53,670 our client knows where to go. 522 522 00:18:53,670 --> 00:18:55,370 It's going to go to its local DNS server 523 523 00:18:55,370 --> 00:18:56,820 for that address resolution. 524 524 00:18:56,820 --> 00:18:58,400 Now that it knows the IP name, 525 525 00:18:58,400 --> 00:18:59,920 anytime it wants to do things 526 526 00:18:59,920 --> 00:19:03,170 to go to the server.Diontraining.com or Diontraining.com, 527 527 00:19:03,170 --> 00:19:04,510 it can do that using the IP, 528 528 00:19:04,510 --> 00:19:06,840 using its local cache on the client. 529 529 00:19:06,840 --> 00:19:08,970 If it's client has expired on that cache, 530 530 00:19:08,970 --> 00:19:10,940 it can then go to its local DNS server. 531 531 00:19:10,940 --> 00:19:12,450 If the local DNS server is expired, 532 532 00:19:12,450 --> 00:19:14,070 it's going to go back to the root server. 533 533 00:19:14,070 --> 00:19:15,230 If the root server is expired, 534 534 00:19:15,230 --> 00:19:16,130 it's going to go all the way back 535 535 00:19:16,130 --> 00:19:18,450 to the authority.Diontraining.com name server 536 536 00:19:18,450 --> 00:19:20,630 and we do this whole process again. 537 537 00:19:20,630 --> 00:19:22,120 All right, so now I want to go ahead 538 538 00:19:22,120 --> 00:19:24,050 and look at my browser and make sure 539 539 00:19:24,050 --> 00:19:26,270 we can get traffic going back and forth 540 540 00:19:26,270 --> 00:19:28,290 now that we've done the DNS part of this. 541 541 00:19:28,290 --> 00:19:31,263 So I'm going to go to Diontraining.com and I'm going to hit go 542 542 00:19:31,263 --> 00:19:34,170 and off it goes with the message. 543 543 00:19:34,170 --> 00:19:36,570 And there we go: DNS, DNS. 544 544 00:19:36,570 --> 00:19:38,130 We're going to go all through that process again 545 545 00:19:38,130 --> 00:19:39,870 so you can see what it looks like, 546 546 00:19:39,870 --> 00:19:42,110 going through, getting to the root DNS server, 547 547 00:19:42,110 --> 00:19:45,280 back to the router, back over to Dion Training's router, 548 548 00:19:45,280 --> 00:19:48,450 back to the switch, down to the authority.DNS 549 549 00:19:48,450 --> 00:19:50,387 and up to the server.DNS. 550 550 00:19:50,387 --> 00:19:51,220 It drops it at the server 551 551 00:19:51,220 --> 00:19:53,040 because there's no DNS record there. 552 552 00:19:53,040 --> 00:19:55,270 And then the authority one sends back its message 553 553 00:19:55,270 --> 00:19:57,260 and says, here is what we have. 554 554 00:19:57,260 --> 00:19:59,161 And so when it does that it goes back through 555 555 00:19:59,161 --> 00:20:01,310 to one router, to the second router, 556 556 00:20:01,310 --> 00:20:03,730 to the root DNS, back to the internet router, 557 557 00:20:03,730 --> 00:20:06,190 over to the company router, over to the company switch 558 558 00:20:06,190 --> 00:20:08,774 and then down to the local DNS server. 559 559 00:20:08,774 --> 00:20:12,180 And then that goes all the way back up to our client. 560 560 00:20:12,180 --> 00:20:14,350 All right, that is the DNS process 561 561 00:20:14,350 --> 00:20:16,310 as we're looking at using hierarchies 562 562 00:20:16,310 --> 00:20:18,320 and going from our local to our root DNS 563 563 00:20:18,320 --> 00:20:20,840 and then over to our authoritative name servers. 564 564 00:20:20,840 --> 00:20:22,730 So at this point, we want to send out a request 565 565 00:20:22,730 --> 00:20:26,277 back to that HTTP server, which is holding Diontraining.com. 566 566 00:20:26,277 --> 00:20:29,540 And at this point, we will be able to send our get message 567 567 00:20:29,540 --> 00:20:32,700 using HTTP and we'll receive the webpage back. 568 568 00:20:32,700 --> 00:20:34,370 So we create our packet. 569 569 00:20:34,370 --> 00:20:36,940 We address it with the Mac address of our default gateway. 570 570 00:20:36,940 --> 00:20:38,900 And that way our company router will send it out 571 571 00:20:38,900 --> 00:20:41,320 to the Dion Training router across the internet. 572 572 00:20:41,320 --> 00:20:42,200 So here we go. 573 573 00:20:42,200 --> 00:20:44,250 We're going to send that HTTP traffic. 574 574 00:20:44,250 --> 00:20:45,850 It goes over to switch zero. 575 575 00:20:45,850 --> 00:20:48,170 From switch zero is going to send it to the company router. 576 576 00:20:48,170 --> 00:20:50,260 The company routers is going to then readdress it, 577 577 00:20:50,260 --> 00:20:52,360 using the IP address that we want to go to, 578 578 00:20:52,360 --> 00:20:53,620 which happens to be the IP address 579 579 00:20:53,620 --> 00:20:55,360 for server.Diontraining.com. 580 580 00:20:55,360 --> 00:20:57,120 And it sends it out to the internet. 581 581 00:20:57,120 --> 00:20:59,210 The internet then says, where does this belong? 582 582 00:20:59,210 --> 00:21:00,930 Finds the right network as it passes it 583 583 00:21:00,930 --> 00:21:02,770 from router to router and eventually getting 584 584 00:21:02,770 --> 00:21:04,130 to the Dion Training router, 585 585 00:21:04,130 --> 00:21:07,640 which hosts the network for server.Diontraining.com. 586 586 00:21:07,640 --> 00:21:08,770 Once it gets to that router, 587 587 00:21:08,770 --> 00:21:10,880 it's going to strip it down to layer two 588 588 00:21:10,880 --> 00:21:13,180 and start using ethernet as it goes to the switch 589 589 00:21:13,180 --> 00:21:14,610 and using Mac addresses. 590 590 00:21:14,610 --> 00:21:18,610 So it does the IP to Mac address conversion using ARP. 591 591 00:21:18,610 --> 00:21:20,650 Once it does that, it hits the switch. 592 592 00:21:20,650 --> 00:21:22,240 The switch knows where it goes and sends it 593 593 00:21:22,240 --> 00:21:23,450 up to the server. 594 594 00:21:23,450 --> 00:21:25,830 Notice it only went from the client to the server. 595 595 00:21:25,830 --> 00:21:27,920 It never touched those DNS servers again, 596 596 00:21:27,920 --> 00:21:29,640 'cause we already did the DNS part. 597 597 00:21:29,640 --> 00:21:31,520 We know what the IP address is. 598 598 00:21:31,520 --> 00:21:32,750 Now, once it gets to the server, 599 599 00:21:32,750 --> 00:21:34,470 the server is going to process that message. 600 600 00:21:34,470 --> 00:21:36,260 In this case, it was a get message saying 601 601 00:21:36,260 --> 00:21:37,350 give me the website. 602 602 00:21:37,350 --> 00:21:39,240 And so it's going to send back the website 603 603 00:21:39,240 --> 00:21:40,550 in a series of packets. 604 604 00:21:40,550 --> 00:21:42,260 In this case, it's only one packet 605 605 00:21:42,260 --> 00:21:44,330 because it's a very small website I'm sending 606 606 00:21:44,330 --> 00:21:47,220 and it goes back across the internet to the company, 607 607 00:21:47,220 --> 00:21:49,770 over to the switch and then up to our client. 608 608 00:21:49,770 --> 00:21:50,940 Now, once I do that, 609 609 00:21:50,940 --> 00:21:53,860 we can go and look at what page it was that we received. 610 610 00:21:53,860 --> 00:21:55,400 This would happen all in the background 611 611 00:21:55,400 --> 00:21:56,910 and you'd see it on your web browser. 612 612 00:21:56,910 --> 00:21:57,870 And there it is. 613 613 00:21:57,870 --> 00:22:00,120 So in this case, I have server.Diontraining.com, 614 614 00:22:00,120 --> 00:22:02,910 also known as www.Diontraining.com. 615 615 00:22:02,910 --> 00:22:05,380 And this is used to simulate the Dion Training homepage 616 616 00:22:05,380 --> 00:22:06,860 within my lab environment. 617 617 00:22:06,860 --> 00:22:08,290 Now, if I actually put pictures on there 618 618 00:22:08,290 --> 00:22:09,170 and things like that, 619 619 00:22:09,170 --> 00:22:10,777 it would make this a much bigger website 620 620 00:22:10,777 --> 00:22:12,560 and it would be a lot of different packets 621 621 00:22:12,560 --> 00:22:14,180 and this purple packet going back and forth 622 622 00:22:14,180 --> 00:22:16,060 would just keep on happening. 623 623 00:22:16,060 --> 00:22:17,620 I would send the one packet over and say, 624 624 00:22:17,620 --> 00:22:18,670 give me the website. 625 625 00:22:18,670 --> 00:22:21,010 And then I would get a whole series of packets back 626 626 00:22:21,010 --> 00:22:22,040 from the web server, 627 627 00:22:22,040 --> 00:22:24,620 with the videos and images and texts that I need 628 628 00:22:24,620 --> 00:22:26,970 to build that website at layer seven, 629 629 00:22:26,970 --> 00:22:29,230 the presentation layer on my client. 630 630 00:22:29,230 --> 00:22:30,980 And that's how you get to see the webpage 631 631 00:22:30,980 --> 00:22:33,750 once you go to something like Diontraining.com. 632 632 00:22:33,750 --> 00:22:35,920 Hopefully this explanation helped you understand 633 633 00:22:35,920 --> 00:22:38,640 a little bit more about how DNS works in the background 634 634 00:22:38,640 --> 00:22:40,590 and how these things layer upon each other 635 635 00:22:40,590 --> 00:22:42,570 from the local to the top level domain 636 636 00:22:42,570 --> 00:22:44,283 and to the authoritative servers.