1; Hand made test packets. 2; By Wouter Wijngaards. 3; These DNS packets contain interesting compression cases. 4; 5;-- next packet -- 6; 0. A valid packet (handmade) 7; id flags qd an ns ar -- header 84242 0000 0001 0001 0000 0000 9; query: qname example.com. qtype A(1) qclass IN(1) 1007 6578616d706c65 03 636f6d 00 0001 0001 11; answer: example.com type class ttl rdatalen 10.x address. 1207 6578616d706c65 03 636f6d 00 0001 0001 00000101 0004 0a203040 13 14;-- next packet -- 15; 0b. correct compression from answer to query. 164242 0000 0001 0001 0000 0000 1707 6578616d706c65 03 636f6d 00 0001 0001 18c00c 0001 0001 00000101 0004 0a203040 19 20;-- next packet -- 21; 1. Compression from query to answer. 224242 0000 0001 0001 0000 0000 23c012 0001 0001 2407 6578616d706c65 03 636f6d 00 0001 0001 00000101 0004 0a203040 25 26;-- next packet -- 27; 2. Compression loop answer 1 to answer 2. 284242 0000 0001 0002 0000 0000 2907 6578616d706c65 03 636f6d 00 0001 0001 30c02d 0001 0001 00000101 0004 0a203040 3107 6578616d706c65 03 636f6d 00 0001 0001 00000101 0004 0a203050 32 33;-- next packet -- 34; 2b. Compression loop answer 2 to answer 1. 354242 0000 0001 0002 0000 0000 3607 6578616d706c65 03 636f6d 00 0001 0001 3707 6578616d706c65 03 636f6d 00 0001 0001 00000101 0004 0a203050 38c01d 0001 0001 00000101 0004 0a203040 39 40;-- next packet -- 41; 3. Compression loop to self (in answer section). 424242 0000 0001 0001 0000 0000 4307 6578616d706c65 03 636f6d 00 0001 0001 44c01d 0001 0001 00000101 0004 0a203040 45 46;-- next packet -- 47; 4. bad compression pointer - to header. 484242 0000 0001 0001 0000 0000 4907 6578616d706c65 03 636f6d 00 0001 0001 50c004 0001 0001 00000101 0004 0a203040 51 52;-- next packet -- 53; 5. bad compression pointer - exceeds packet. 544242 0000 0001 0001 0000 0000 5507 6578616d706c65 03 636f6d 00 0001 0001 56c0bb 0001 0001 00000101 0004 0a203040 57 58;-- next packet -- 59; 6. double OPT record. 60; id flags qd an ns ar -- header 614242 0000 0001 0001 0000 0002 62; query: qname example.com. qtype A(1) qclass IN(1) 6307 6578616d706c65 03 636f6d 00 0001 0001 64; answer: example.com type class ttl rdatalen 10.x address. 6507 6578616d706c65 03 636f6d 00 0001 0001 00000101 0004 0a203040 66; additional: . OPT 4096 6700 0029 1000 00000000 0000 68; additional: . OPT 4096 6900 0029 1000 00000001 0000 70 71