DNS Iterative Resolution Protocol Trace

Illustrative trace (not a recording)

Illustrative DNS iterative resolution trace. TODO(UJ): commit the capture file (pcap / trace text) to replace this illustrative sequence with actual packet timestamps and addresses.

TODO(UJ): commit the capture file (pcap/trace text) from the 2026-08-07 experiment.

Derived state: TESTED

Total RTT11.05 ms

Payload Size64B

ProtocolPOSIX

TTLn/a

Cache StatusMISS (0x01)

ProvenanceIllustrative trace

Protocol Execution Trace (Scrubbable Sequence)

09.000 msAppBrowser invokes getaddrinfo('example.com')

09.031 msKernelOS Resolver miss → socket(AF_INET, SOCK_DGRAM, 0)

09.052 msNICsendto() emits UDP datagram to Recursive Resolver 1.1.1.1:53

09.101 msRecurseCloudflare 1.1.1.1 receives query → Cache Miss

09.440 msRootRoot Server (.) 198.41.0.4 returns TLD referral

10.004 msTLDTLD Server (.com) 192.5.6.30 returns Glue A record

10.773 msAuthAuthoritative Server ns1.example.com replies AA=1

11.050 msAppApplication receives IP 93.184.216.34

Active Step: Browser invokes getaddrinfo('example.com')POSIX

Checks POSIX VFS /etc/hosts & system resolver cache

Wireshark DNS Packet Inspector (RFC 1035 Datagram)

Wireshark Hex Dump (UDP 53)

0000 00 15 5d 01 02 03 00 1c 42 11 22 33 08 00 45 00

0010 00 3c 1a 2b 40 00 40 11 7c 2a c0 a8 01 64 01 01

0020 01 01 d4 31 00 35 00 28 fe 34 1a 2b 01 00 00 01

Wire Spec Decoded Header

Transaction ID:0x1A2B

Flags:0x0100 (RD=1, RA=0, TC=0)

Question Name:example.com (Type A, Class IN)

Answer A Record:93.184.216.34 (TTL 300)

Loading Context Inspector...