Nothing special on Ethernet level. On the IP level, we set the source IP to the IP of blackboard.ru.nl (131.174.57.69). The destination IP should be the IP of the nameserver we're using (204.61.216.27). Nothing special on the UDP level. On the DNS level we use the query as can be found in the capture file: 4c1901200001000000000001026c6b0000ff00010000291000000080000000 For the rest, we craft the packet as normally. This way, the nameserver will send its reply to 131.174.57.69.