What exactly does DNS resolution do? I ran it with nslookup.

Last month I changed the router’s DNS to 223.5.5.5 , let me knock on the last step of the tutorial ipconfig /flushdns . I typed this order no less than ten times, and copied it every time without thinking about what it meant. Last week, my colleague asked me, "Why can't I open the web page after changing the DNS? It took five or six minutes to get better." I got stuck. In order to make this clear, I used nslookup to run the entire analysis process of my website, and I easily figured out the calculation of cache and TTL.

Let’s first explain clearly what DNS is translating.

The computer network only recognizes the IP address. I wrote an article about what IP is , just say one thing here: Machine recognition 49.51.202.150 People can only remember this kind of number www.shunot.com Such a name. What DNS does is translation - you type in the URL, it finds the corresponding IP, and the browser uses the IP to connect to the server. It's equivalent to the 114 directory assistance desk before making a call. You give your name and it gives you your number.

When there was no DNS at the earliest, the "address book" of the entire Internet was a hosts file. All domain names and IPs were written in a text, and they were manually downloaded and synchronized. This file is still sitting on your computer: C:\Windows\System32\drivers\etc\hosts, you can see a line when you open Notepad 127.0.0.1 localhost. The first time I encountered it was in the school computer room. Many things were accomplished by modifying this line of files. Its rules have not changed to this day: There is it in hosts, and the system uses it directly without asking DNS at all. . So when troubleshooting DNS problems, first take a look at this file to see if there are any strange lines inserted into it - some cracking software likes to write things in it. If you write one line, a certain website will be permanently "unavailable" on your computer.

Who was asked during an analysis?

Your computer doesn't ask all over the world, it only asks a "recursive resolver" - the default is the DNS automatically issued by the operator, because DHCP conveniently sends the DNS address together when it sends the address. I talked about this in detail when I wrote the DHCP article. . What is filled in in my router is 223.5.5.5 , the DNS queries of all the devices in the house are finally handled by it.

You ask it once and it must hand over a final answer. This is called a recursive query. As for how it does its own errands, you don’t have to worry about it.: It first asked the root server "Who knows .com", and the root said "This is managed by the .com servers".」 ； It asked again.com "Who knows? shunot.com 」, .com said "Ask the authoritative server of this domain name」 ； The authoritative server finally hands over the IP. Questions are asked level by level, and each level only tells you "who to ask next." This method is called iterative query. There are 13 groups of root servers around the world, one group of servers for each top-level domain, and each domain name has its own authoritative DNS hanging behind it. The three-layer query usually ends in tens of milliseconds.

The words recursion and iteration are hard to pronounce for the first time. Let me give you a notation.: Recursion is when you turn around and ask the shopkeeper only once. Iteration is when the parser runs errands and asks for directions. . You only have one question and one answer to deal with the recursive parser, and all the legwork is on its end. There is another piece of trivia: This question and answer uses UDP port 53, and one round trip is only a few dozen bytes. Most of the time, DNS uses UDP instead of TCP. This is because the package is small, one question and one answer, and three handshakes are too wasteful. Those who value reliable transmission for video conferencing and gaming use TCP. Check the house number. If you lose it, ask again.

Verify that there is a ready-made command for this step: nslookup www.shunot.com 223.5.5.5 , meaning "Don't use the default one, specify the 223.5.5.5 」. The top two lines of the returned result say which server you are asking about, and the Address below is the answer. The most commonly used method of nslookup is to specify different servers to check each one and compare the answers.

The answer is not always asked: three-layer notebook

If every time you open a web page, you have to run through the root, top-level domain, and authoritative layers, no matter how fast the network is, it won't be able to handle it. So the answers will be written down in a small notebook, with three levels in total.: The browser has its own cache ； The system has its own cache, ipconfig /displaydns It can be turned out in its entirety, with domain names and IPs listed one by one. ； outermost, 223.5.5.5 The recursive parser keeps the largest notebook shared by everyone who asks.

Next to each record is a TTL (Time To Live), in seconds, which is the "freshness period" set by the domain name owner in his own DNS background. I actually measured the TTL of my website to be 120 seconds - the answer is cached for up to two minutes, and when the countdown reaches zero, you have to ask the authority again. It’s particularly interesting to stare at this number: I checked twice in a row. The first time the TTL was returned was 95. Then I checked again after ten seconds and the TTL returned was 120. 95 means there are still 95 seconds left in the cache. ； The old account expired ten seconds later, and the parser asked the authority again and got back a full health 120. The jump of a number explains both "caching" and "countdown" clearly.

Check the server www.qq.com more interesting: 223.5.5.5 Give me TTL 44, 119.29.29.29 Give 86, 8.8.8.8 Give 120. For the same domain name, the three parsers have different countdowns - because they each copy the answer into their own notebooks at different times, what you check is always "how many seconds are left for me." Once, a colleague used two tools to find out the mismatched time, thinking which DNS server was broken. In fact, it was just that the caches of each server were different, and they were all working normally.

By the way, a phenomenon that can be perceived in daily life: The first time I opened the web page after clearing the cache, it was half a beat slower than usual before the text came out, but the second time it was faster. This is not an illusion. The local notebook is empty. This time I really have to go to the parser layer to get the answer. ； I took it back and wrote it down. The next few blows were all hit by the notebook. If you want to see with your own eyes how many entries you have recorded on your computer, type ipconfig /displaydns , I can’t even scroll through one screen of my old laptop. It’s full of names of websites I’ve visited in the past few days and the number of seconds they have left. It’s like a drawer of expired sticky notes.

Why does the DNS change not take effect immediately?

Going back to my colleague's question, it took five or six minutes for him to change the DNS before it took effect. The problem was the cache. Changing the DNS only changed the "who to ask in the future", not the "already memorized answer". Each of the three layers of books has its own destiny.:

• This layer of the system is the best to handle. ipconfig /flushdns It clears as soon as you hit it, that's why the tutorial lets you hit it ；
• This layer of the browser is the most stubborn. The new version of Chrome has even closed the entry to clear the cache. The easiest way is to exit and re-open. ；
• You can't reach the parser layer. 223.5.5.5 The old answers saved in the book can only wait for its own TTL to return to zero - this is the whole truth of "wait a few minutes and it will be fine".

After making the changes, I want to confirm whether they have taken effect or not. Don’t just stare at the web page and wait, use nslookup.: knock nslookup www.shunot.com (Without the second parameter), look at who is displayed in the top two lines of "Server". It displays as your newly filled address, indicating that this layer of the system has been replaced. ； The old address is still displayed. Most likely the network card has not been reconfigured. Just disconnect and reconnect to WiFi. The time I did it remotely for a colleague, he was stuck here - the DNS had been changed, and the computer still asked the old server with the old configuration.

There is another one that leaks easily: Apps such as WeChat and QQ do not use the system's cache, so you need to keep a separate cache yourself. Sometimes the web page is completely fine but it just spins around. Restarting the app is more effective than anything else. By the way, let me talk about a classic symptom - if you can send messages on WeChat but cannot open web pages, it is probably a DNS disease.: WeChat remembers its server address by itself and does not rely on checking it. ； You need to check the web page immediately, and only go around if you can't find it. How to distinguish between packet loss and DNS I have written , one sentence version: Pinging the public IP address works, but pinging the domain name fails, and the DNS problem cannot be solved.

The two computers found different IPs, so it was not hijacking.

I check www.qq.com I also bumped into something: 223.5.5.5 Return two IPs ( 121.14.77.221 and 121.14.77.201 ), 119.29.29.29 These two are also returned, but in reverse order. This is not about who is being hijacked, but the CDN method used by large websites - multiple servers are linked to one domain name, and the DNS is sorted by "who is closest to you", and the device is usually used first. Your family and mine found different IP addresses when checking the same video website. This is normal, so don’t rush to call the police yet.

The real hijacking looks different: The IP you found cannot be opened at all, or there are only advertising pages when you enter. Verification still relies on nslookup, specify the question 8.8.8.8 Check it with the person who asked the operator. If the answers from the two sides are ridiculously different, you will be suspicious. There is also an old topic behind this: "Operators rush to answer UDP port 53" - what you are clearly asking is 8.8.8.8 , the operator answered for it halfway, I went through a complete pitfall in the article about changing DNS with optical modem. . In addition, if the DNS in your router is changed back every three days, you must first suspect that the machine has been tampered with. The article about self-examination after being hacked There is a list inside.

What are the symptoms to suspect DNS, in this order

The finishing sequence is arranged for you.: If the web page cannot be opened, first ping the gateway and then ping the public IP to determine whether it is a disconnection or a DNS problem. ； nslookup specified 223.5.5.5 Check it out ； After that, flushdns and clear the local cache. ； I haven’t gone into the backend of the router to change the DNS yet. My Xiaomi phone was modified in 31.1 ； If that doesn't work, check out the cat level. By the way, IPv6 also has its own set of DNS queries, which check AAAA records. The v6 address article I talked about the coexistence of the two. After this set of steps, the pitfalls of DNS can basically be eliminated by yourself.