please explain, i do not have understand what you want do.
0x8105 are two bytes, 0x81 and 0x05
the conversion is "\81\05", but if on the field on the packet is on reverse order is "\05\81"
Trying to achieve the objective to drop responses with DNS Refused, as RFC1035 inform us.
The code is suposed to be 5
https://www.rfc-editor.org/rfc/rfc1035#section-4.1.1 -> see page 27
I see this 0x81 in some anti DDoS systems, like NSFocus. I guess is because (see page 26,27):
8 = RA
Recursion Available - this be is set or cleared in a response, and denotes whether recursive query support is available in the name server.
1 = QR
A one bit field that specifies whether this message is a query (0), or a response (1).
But I don't know if I am correct.