typedef struct//报文head
{
unsigned short id;
unsigned short flags;
unsigned short ques;
unsigned short answer;
unsigned short author;
unsigned short addition;
}DNSHEAD,*pDNSHEAD;
typedef struct//报文的查询部分
{
unsigned short type;
unsigned short class;
}SEARCH,*pSEARCH;
void genDNSPacket(char *addr,char *dnssendbuff)
{
pDNSHEAD pdnshead = (pDNSHEAD)malloc(sizeof(DNSHEAD));
pSEARCH psearch = (pSEARCH)malloc(sizeof(SEARCH));
pdnshead->id = htons(0x0000);
pdnshead->flags = htons(0x000);
pdnshead->ques = htons(0x0001);
pdnshead->answer = htons(0x0000);
pdnshead->author = htons(0x0000);
pdnshead->addition = htons(0x0000);
memcpy(dnssendbuff,pdnshead,sizeof(DNSHEAD));//将head加到dnssendbuff里面，结果dnssendbuff里面没有这部分
printf("sizeof(DNSHEAD)=%d\n",sizeof(DNSHEAD));
printf("dnssendbuff=%s\n",dnssendbuff);
char *domain = (char *)malloc(16*sizeof(char)); //3www6hao1233com0
char num;
char *pbuf;
int length = 0;
num = 0x03;
pbuf = "www";
memcpy(domain + length,&num,sizeof(num));
length += sizeof(num);
memcpy(domain+ length,pbuf,strlen(pbuf));
length += strlen(pbuf);
num = 0x06;
pbuf = "hao123";
memcpy(domain + length,&num,sizeof(num));
length += sizeof(num);
memcpy(domain + length,pbuf,strlen(pbuf));
length += strlen(pbuf);
num = 0x03;
pbuf = "com";
memcpy(domain + length,&num,sizeof(num));
length += sizeof(num);
memcpy(domain + length,pbuf,strlen(pbuf));
length += strlen(pbuf);
printf("domain=%s\n",domain);
num = 0x00;
memcpy(domain + length,&num,sizeof(num));
length += sizeof(num);
memcpy(dnssendbuff + sizeof(DNSHEAD),domain,16);/将domain www.hao123.com加到报文，domain在报文里有
printf("strlen(domain)=%d\n",strlen(domain));
memcpy( dnssendbuff, domain, 16);
psearch->type = htons(0x0001);
psearch->class = htons(0x0001);
memcpy(dnssendbuff + sizeof(DNSHEAD) + 16,psearch,sizeof(SEARCH)); //将search加到dnssendbuff里面，结果dnssendbuff也里面没有这部分
printf("strlen(dnssendbuff)=%d\n",strlen(dnssendbuff));
printf("dnssendbuff=%s\n",dnssendbuff);
}
代码原型是我在网上找的，改了之后做个示例
我ping hao123.com,然后wireshark抓包得到的结构看了下，发现我在程序里边的head部分和最后面的查询类和查询类型部分没加到报文里边，报文打出来之后只出现了个 3www6hao1233com ,没发现head和search部分，估计是我的这两部分的程序不正确，希望牛人帮我看下，谢谢！
关于报文的格式我看过了
head+domain+search三部分
head有6部分共12字节，这个结构我清楚，但是程序没把head和search加到报文里，结果发到 220.181.111.78 后收不到东西
