tcp - Malformed DNS Request Packet -

i've been working on project involves sending dns requests information (not actual domains) in questions (2 of them). i've been tracking packets wireshark.

here tcp dump of packet created.

00000000 00 02 01 00 00 02 00 00 00 00 00 00 01 32 03 65

00000010 6e 64 03 63 6f 6d 00 00 01 00 01 01 32 04 73 61

00000020 76 65 03 63 6f 6d 00 00 01 00 01

........ .....2.e

nd.com.. ....2.sa

ve.com.. ...

the i.d. , qdcount should 2, recursion desired, , domains shown correct. wireshark saying malformed dns packet. idea wrong packet?

ok, so:

• if you're doing transport-layer networking yourself, code determine whether it's going on udp or tcp, specifying, when creating socket on send packet, whether it's udp or tcp socket;
• tcp used if packet won't fit in maximum-sized udp packet;
• if you're sending on tcp, need precede header, per section 4.2.2 "tcp usage" in rfc 1035.

"maximum-sized" bit vague. rfc 791, ipv4 specification, says, in section 3.1 "internet header format":

total length:  16 bits    total length length of datagram, measured in octets,   including internet header , data.  field allows length of   datagram 65,535 octets.  such long datagrams   impractical hosts , networks.  hosts must prepared   accept datagrams of 576 octets (whether arrive whole   or in fragments).  recommended hosts send datagrams   larger 576 octets if have assurance destination   prepared accept larger datagrams.    number 576 selected allow reasonable sized data block   transmitted in addition required header information.    example, size allows data block of 512 octets plus 64 header   octets fit in datagram.  maximal internet header 60   octets, , typical internet header 20 octets, allowing   margin headers of higher level protocols. 

however, these days, old networking hardware impose maximum packet size limit low 576 bytes if not gone, , real-world "maximum packet size" ethernet packet size - total length of 1518 bytes, 14 bytes of ethernet header , 4 bytes of fcs, leaving 1500 bytes of payload. udp, typical ipv4 header length of 20 bytes , udp header length of 8 bytes, that's 1472 bytes of data, it's enough use tcp rather udp dns messages larger 1472 bytes (ip fragmentation , reassembly happen if hop in network route can't handle 1500-byte ipv4 packet; increase chances of packet not getting through, as, if 1 fragment gets through other doesn't, entire packet doesn't through).