DNS We see an iterative name resolution with DNS, for the address "website.nat.ch-geni- net.instageni.research.umich.edu" (in this example). First, the DNS server returns a list of root name servers: 77637 IN NS e.root-servers.net. 77637 IN NS a.root-servers.net. 77637 IN NS h.root-servers.net. 77637 IN NS j.root-servers.net. 77637 IN NS b.root-servers.net. 77637 IN NS m.root-servers.net. 77637 IN NS c.root-servers.net. 77637 IN NS i.root-servers.net. 77637 IN NS g.root-servers.net. 77637 IN NS I.root-servers.net. 77637 IN NS f.root-servers.net. 77637 IN NS d.root-servers.net. 77637 IN NS k.root-servers.net. 518071 IN RRSIG NS 8 0 518400 20170411170000 20170329160000 61045. EhdlynzhYoqVrNs2csvZwCDUhQbDyUs8EujQ+XVKeQ02S2u0ZN39GY9h pBa7XpOyFAINfYWNvWVLi1nkpJ7JKS+s4Gg/fU0Nw1MXc2hsbtdsduMs x9tNRjq5RduDfGBZLvNEikloBndMU4esREkLtbSXrXp0TuvRpl3g5w5j +km7Ilmfv7KrfhZ16w6kKV801ye3yrQr9ow7/XBvUlvDnkcLXUphbfE3 M8vOF+5ABzb7KQp28S5Wel6mrC412jZQgGmdkdCVZARJtc+tKBOoLr64 OmwCMM+phVrLTkx9vdnZpnx9QBB7eqdSOqG9x09R7FiHVyaikue Wed Ns txlotQ== ;; Received 1097 bytes from 127.0.0.1#53(127.0.0.1) in 19 ms Then it queries one of the root name servers ("c.root-servers.net" in this example), and that returns a list of .edu servers: edu. edu. edu. edu. edu. edu. edu. 172800 IN NS f.edu-servers.net. 172800 IN NS c.edu-servers.net. 172800 IN NS g.edu-servers.net. 172800 IN NS d.edu-servers.net. 172800 IN NS I.edu-servers.net. 172800 IN NS a.edu-servers.net. 86400 IN DS 28065 82 4172496CDE85534E51129040355BD04B1FCFEBAE996DFDDE652006F6 F8B2CE76 edu. 86400 IN RRSIG DS 81 86400 20170411170000 20170329160000 61045. RrZnh2YsklX8cXI1YuiVY9mBh79izFT8HuEc0dxU9B8fKbC5ddQZN Prw d2z0Rn/Bhym6yAABYOu+5j1+RPXNMLcW2q Acktyw4i3wp4UiGowlcQla dd5PMODvNrFc8lJpahPhwWcCbK8okgyP1AL9dNtWGcgv7+2zVB1e5vWN n5b0VtthU4p8/X4JI5zRZTyP9Mwz7hPkNFTeeAumjm+hIHJKRAQ211Bz 92f5nRgaJyylfTq1w9AXRJjE9gnbYRVm32BhOu EPh1wUddmsN788dYmc xzbbNjZDnAksPoopkup QinhvgSBO9Zf9d21dtR3WQLt1w2YoX46liko0 ;; Received 651 bytes from 192.33.4.12#53(c.root-servers.net) in 43 ms rUJnNQ== Next, the "c.edu-servers.net." name server returns a list of name servers for the umich.edu. Domain: umich.edu. 172800 IN NS dns.cs.wisc.edu. umich.edu. 172800 IN NS dns2.itd.umich.edu. umich.edu. 172800 IN NS dns1.itd.umich.edu. 9DHS4EP5G85PF9NUFK06HEK0048QGK77.edu. 86400 IN NSEC3 1 1 0 - 9N4FQMDDEN9N918F7VUF86JHJF574LHS NS SOA RRSIG DNSKEY NSEC3PARAM 9DHS4EP5G85PF9NUFK06HEK0048QGK77.edu. 86400 IN RRSIG NSEC3 8 2 86400 20170405183649 20170329172649 43544 edu. unQy39EYi/666eEaXxmUQcsEgE/FtqxKCMVuODd408NhWp8ga kukJNS OM1xfx0916xtQyVD2IXaoZ6pJCSENtY08AUGja7Uvx2zGLpmH2a3gAWK gvZqHpkLchFQrlFcP3Qg6dqm60JbjBBHDIcWyl8Q4ic5aYM1F15ewzAO YOQ= 86400 IN NSEC3 1 1 0 - NOS8G1ANJ5QIKT46L3QM4OLBQD9V72K5.edu. 09PNA70PKK04360E0034N6ANUNH47GJ5 NS DS RRSIG NOS8G1ANJ5QIKT46L3QM40LBQD9V72K5.edu. 86400 IN RRSIG NSEC3 8 2 86400 20170405172140 20170329161140 43544 edu. ReOneHxFyyuuqcHa FrBftXfW5VCLG a0XCKWZAan1zW6vIQ3OtATJOUHr +gR6UDb8nH8C+KAQCCdxanZM5feAOCsEDxl1X6D36nuMfVb86k3q8UZ/ jWy7OqDL2PMzRNjGIOSdwl49BUx7VhGXjlt9ev87dFa1zHprJJHf8KCe mgU= ;; Received 682 bytes from 192.26.92.30#53(c.edu-servers.net) in 30 ms And then "dns2.itd.umich.edu" returns name servers for the subdomain instageni.research.umich.edu. instageni.research.umich.edu. 300 IN NS ns.instageni.research.umich.edu. instageni.research.umich.edu. 300 IN NS ns.emulab.net. ;; Received 141 bytes from 192.12.80.222#53(dns2.itd.umich.edu) in 43 ms Finally, from "ns.emulab.net" we get the address of website.nat.ch-geni- net.instageni.research.umich.edu.: website.nat.ch-geni-net.instageni.research.umich.edu. 1 8.instageni.research.umich.edu. pcvm2-8.instageni.research.umich.edu. 30 IN A 192.41.233.62 instageni.research.umich.edu. 30 IN NS ns.emulab.net. instageni.research.umich.edu. 30 IN NS ns.instageni.research.umich.edu. ;; Received 195 bytes from 155.98.32.70#53(ns.emulab.net) in 39 ms IN CNAME pcvm2- NAT We see NAT rewriting packet headers. Here are the packets in the LAN: 16:53:13.663719 IP 192.168.100.157.57962 > 192.41.233.62.80: Flags [S], seq 3245904370, win 29200, options [mss 1460,sackOK,TS val 1688452 ecr 0,nop,wscale 7], length 0 16:53:14.231939 IP 192.41.233.62.80 > 192.168.100.157.57962: Flags [S.], seq 3992044697, ack 3245904371, win 28960, options [mss 1460,sackOK,TS val 1691466 ecr 1688452,nop,wscale 7], length 0 16:53:14.232738 IP 192.168.100.157.57962 > 192.41.233.62.80: Flags [.], ack 1, win 229, options [nop,nop,TS val 1688595 ecr 1691466], length 0 And here are the same packets on the WAN: 16:53:14.032389 IP 172.17.3.4.57962 > 192.41.233.62.80: Flags [S], seq 3245904370, win 29200, options [mss 1460,sackOK,TS val 1688452 ecr 0,nop,wscale 7], length 0 16:53:14.032440 IP 192.41.233.62.80 > 172.17.3.4.57962: Flags [S.], seq 3992044697, ack 3245904371, win 28960, options [mss 1460,sackOK,TS val 1691466 ecr 1688452, nop,wscale 7], length 0 16:53:14.299903 IP 172.17.3.4.57962 > 192.41.233.62.80: Flags [.], ack 1, win 229, options [nop,nop,TS val 1688595 ecr 1691466], length 0