How can you verify if a DNS response was delivered over UDP or TCP in Wireshark?

• A. DNS responses typically occur over UDP port 53; if a response is over TCP, it will appear on a TCP stream and show a TCP 3-way handshake preceding the DNS data.
• B. DNS responses typically occur over TCP port 53; if a response is over UDP, it will appear on a UDP stream.
• C. DNS responses are never seen in Wireshark.
• D. DNS responses are always over SSH.

Answer: (B)

DNS responses are normally carried over UDP on port 53. In Wireshark you can verify the transport by looking at the DNS response’s transport layer: a UDP packet means the response used UDP, while a TCP stream means DNS ran over TCP. If DNS is delivered over TCP, you’ll see a TCP stream with the DNS data preceded by the TCP 3‑way handshake. A quick way to check is to filter for dns and then Follow UDP Stream to inspect UDP-based exchanges or Follow TCP Stream for TCP-based exchanges. DNS over TCP is used for large responses or specific cases, otherwise UDP is the default.