DNS and ICMP Network Traffic Analysis.

In this guided lab, customers reported they could not load www.yummyrecipesforme.com and were seeing a "destination port unreachable" error. The scenario provides a tcpdump log of the client computer's traffic. My part was to review the provided log, analyze the DNS and ICMP traffic, and write up the incident report.

1. ReviewRead the scenario and the provided tcpdump log
2. ParseRead each line: timestamp, IPs, ports, flags, and query type
3. CorrelateMatched each DNS query to its ICMP response
4. LayerMapped the failure to the TCP/IP model
5. ReportWrote the incident report and next steps

• The client at 192.51.100.15 sent UDP DNS queries to 203.0.113.2 on port 53 for the A record of yummyrecipesforme.com.
• The query was sent three times, at 13:24:32, 13:26:32, and 13:28:32.
• Every attempt got an ICMP "udp port 53 unreachable" response, so the name never resolved and no HTTPS traffic was sent.
• Likely causes: a DoS attack that took the DNS server down, or a firewall rule blocking UDP port 53.

• Application: DNS is the service that failed.
• Transport: the queries used UDP to port 53, where the failure shows up.
• Internet: ICMP carried the error back, so the host was reachable even though the DNS service was not.
• Network access: packets were moving in both directions.

• tcpdump Packet Analysis
• DNS
• ICMP
• UDP & Ports
• TCP/IP Model
• Incident Documentation

• An ICMP error can show that a host is up while the service on it is not.
• When DNS fails, everything that depends on a domain name fails with it.
• Template wording is not always technically exact, so it is worth checking what the packets actually say.