title: DNS query format little-big endian problem in header structure
body: <p>I have a question about DNS query Format ....</p>
  
  <p>I know this structure as the structure of DNS query header ...</p>
  
  <pre><code>typedef struct _DNS_HEADER {
      unsigned short id;       // identification number
      unsigned char qr :1;     // query/response flag
      unsigned char opcode :4; // purpose of message
      unsigned char aa :1;     // authoritative answer
      unsigned char tc :1;     // truncated message
      unsigned char rd :1;     // recursion desired
      unsigned char ra :1;     // recursion available
      unsigned char z :1;      // its z! reserved
      unsigned char ad :1;     // authenticated data
      unsigned char cd :1;     // checking disabled
      unsigned char rcode :4;  // response code
      unsigned short q_count;  // number of question entries
      unsigned short ans_count; // number of answer entries
      unsigned short auth_count; // number of authority entries
      unsigned short add_count; // number of resource entries
  } DNS_HEADER;
  </code></pre>
  
  <p>+ question query and ...</p>
  
  <p>but there is a problem here:
  I created a socket <code>socket(AF_INET,SOCK_DGRAM,IPPROTO_UDP)</code> and i created a query request:</p>
  
  <pre><code>id = htons(10000);
  qr = 0;
  opcode = 0
  aa = 0
  tc = 0
  rd = 1
  ra = 0
  z = 0 
  ad = 0
  cd = 0
  q_count = 1
  ans_count = 0
  auth_count = 0
  add_count = 0
  </code></pre>
  
  <p>and my question -></p>
  
  <pre><code>3,'w','w','w',4,'s','i','t','e',3,'c','o','m',0
  
  TYPE = htons(1)
  CLASS = htons(1)
  </code></pre>
  
  <p>I sent this request to my special DNS server (bind) and I think there was a problem. Sometimes DNS server didn't responded me and even on response, it wasn't a true response (everything was 0 and nothing received except same header (12-BYTE))</p>
  
  <p>I searched and I found out that there is a problem with my DNS header and it Must be like this -></p>
  
  <pre><code>typedef struct _DNS_HEADER {
      unsigned short id;       // identification number
  
      unsigned char rd :1;     // recursion desired
      unsigned char tc :1;     // truncated message
      unsigned char aa :1;     // authoritative answer
      unsigned char opcode :4; // purpose of message
      unsigned char qr :1;     // query/response flag
  
      unsigned char rcode :4;  // response code
      unsigned char cd :1;     // checking disabled
      unsigned char ad :1;     // authenticated data
      unsigned char z :1;      // its z! reserved
      unsigned char ra :1;     // recursion available
  
      unsigned short q_count;  // number of question entries
      unsigned short ans_count; // number of answer entries
      unsigned short auth_count; // number of authority entries
      unsigned short add_count; // number of resource entries
  } DNS_HEADER;
  </code></pre>
  
  <p>something about little-big endian. I changed my structure to this structure and I sent request and DONE - everything worked and there wasn't any problem, but this is my problem: I don't get it what this is this. Yes, I read about little-big endian a little but still i don't get it:</p>
  
  <ol>
  <li>Why haven't other websites that teaches about DNS format mentioned this? They teach with the first structure.</li>
  <li>What is this? Why we must change the higher 8 bits of the second 16 bits to be the lower 8 bits of the second 16 bits?</li>
  </ol>