I just read about DNS protocol, and found, that the name field can be writen in two ways: lenght of the next label the label lenght of the next label the label ... zero-byte pointer to the previous name field Next is the original article fragment: The Resource Record Name field is encoded in the same way as the Question Name field unless the name is already present elsewhere in the DNS message, in which case a 2-byte field is used in place of a length-value encoded name and acts as a pointer to the name that is already present. So, my question is, how can I determine the first or the second way is using in a package?