4/23/2018 Understanding Cisco Cybersecurity Fundamentals

1.17 Understanding the TCP/IP Protocol Suite

Domain Name System

DNS is another one of the basic IP services that are required for host-to-host communications over an IP network. It
provides an efficient way to convert human-readable names of IP end systems into machine-readable IP addresses
necessary for routing.

Like ARP and DHCP, DNS may be leveraged to carry out attacks. If DNS is compromised, threat actors can cause victims
to establish connections with fraudulent, malicious systems. DNS can be used to covertly tunnel data from an internal
compromised host out to systems controlled by the attacker. Because DNS is a UDP-based service, it can be leveraged in
amplification DDoS attacks. To recognize, analyze, and accurately report on such attacks, security analysts need a solid
understanding of DNS basics.

DNS is a globally distributed dynamic database that is used to translate names to IP addresses. DNS frees the users of IP
networks from the burden of needing to remember the IP addresses. Without this freedom, the World Wide Web would not
be as popular or as usable as it has become.

The translation process is accomplished by a DNS resolver. The DNS resolver could be a client application such as a web
browser or an e-mail client, or a DNS application such as BIND sending a DNS query to a DNS server.

DNS uses TCP and UDP port 53. TCP port 53 is used for zone transfers when replicating the DNS database between
different DNS servers. UDP port 53 is used for performing DNS queries from the clients.

DNS is a deep topic to which this section provides only a basic introduction. Entire books have been written solely on DNS.
While you certainly will not learn everything there is to know about DNS in this course, you will learn much more about it

https://ondemandelearning.cisco.com/cybersec-nil/secfnd/sections/1/pages/17 1/2
4/23/2018 Understanding Cisco Cybersecurity Fundamentals

(such as DNS functions, DNS-based attacks, DNS security solutions, and why a security analyst needs to understand DNS)
in upcoming sections.

Content Review Question

What service does the DNS protocol provide?

points to a website proxy device

resolve IP addresses to MAC addresses

user-friendly hostname resolution to an IP address

resolves a NetBIOS hostname to a MAC Address

Submit

Content Review Question

Which one of the following options describes the protocol and port that is used by DNS?

TCP 53

UDP 53

UDP 53 and TCP 53

any registered port

Submit

https://ondemandelearning.cisco.com/cybersec-nil/secfnd/sections/1/pages/17 2/2