DNS and CLDAP traffic

• DNS traffic

  • SRV records resolution
    • _service._protocol.DnsDomainName
    • Ex: _ldap._tcp.sitename._sites.dc._msdcs.domainname to locate a domain controller inside a given site

• CLDAP traffic

  • Obtaining the closest domain controller
  • DsGetDcName() API, implemented by a pseudo RPC call to Active Directory
    • Site name is kept in cache (DynamicSiteName registry value)
  • ethereal display filter: ldap && udp
  • Documented in the Locating Active Directory Servers section of Windows 2000 Resource Kit documentation