DNS poisoning in Computer Networks - Step-by-Step Execution

Concept Flow - DNS poisoning

User types website name

↓

DNS query sent to DNS server

↓

DNS server checks cache

↓

Is cache poisoned?

Yes→Return fake IP address

↓

User visits wrong site

↓

Return correct IP address

↓

User visits correct site

This flow shows how a DNS query can be intercepted if the DNS server cache is poisoned, causing the user to be sent to a fake website.

Execution Sample

Computer Networks

User types 'example.com'
DNS query sent to DNS server
DNS server returns IP address
User connects to IP address

This shows the normal DNS lookup process where the user gets the correct IP address for a website.

Analysis Table

Step	Action	DNS Server Cache Status	IP Address Returned	User Outcome
1	User types 'example.com'	N/A	N/A	N/A
2	DNS query sent to DNS server	Cache checked	N/A	N/A
3	Cache poisoned?	Yes	Fake IP (attacker site)	User visits fake site
4	User connects to IP	N/A	Fake IP (attacker site)	User at attacker site
5	End	N/A	N/A	User misled by fake site

💡 Execution stops because DNS server returns fake IP due to cache poisoning.

State Tracker

Variable	Start	After Step 2	After Step 3	Final
DNS Server Cache	Clean	Checked	Poisoned with fake IP	Poisoned with fake IP
IP Address Returned	None	None	Fake IP	Fake IP
User Destination	None	None	Fake site	Fake site

Key Insights - 3 Insights

Why does the DNS server return a fake IP address?

Because the DNS server cache was poisoned with a fake IP, as shown in execution_table step 3.

Does the user know they are visiting a fake site?

No, the user trusts the IP returned by the DNS server and is unknowingly sent to the fake site (execution_table step 4).

What triggers the DNS server to return the fake IP?

The DNS server cache being poisoned before the query is processed, shown in variable_tracker for DNS Server Cache after step 3.

Visual Quiz - 3 Questions

Look at the execution_table at step 3, what IP address does the DNS server return?

A No IP address

B Correct IP address

C Fake IP address

D User's IP address

💡 Hint

Check the 'IP Address Returned' column at step 3 in execution_table.

At which step does the user get redirected to the fake website?

A Step 4

B Step 3

C Step 2

D Step 5

💡 Hint

Look at the 'User Outcome' column in execution_table for when the user connects to the IP.

If the DNS server cache was not poisoned, what would change in the execution_table?

A User would visit fake site at step 4

B IP Address Returned would be correct IP at step 3

C DNS query would not be sent

D User types a different website

💡 Hint

Refer to the 'DNS Server Cache Status' and 'IP Address Returned' columns in execution_table.

Concept Snapshot

DNS poisoning tricks a DNS server into giving a fake IP address.
User types a website name and sends a DNS query.
If the DNS cache is poisoned, the server returns a wrong IP.
User unknowingly visits a fake, possibly harmful site.
Protect by securing DNS servers and using DNSSEC.

Full Transcript

DNS poisoning happens when a DNS server's cache is corrupted to return a fake IP address for a website. When a user types a website name, their computer asks the DNS server for the IP address. If the DNS server's cache is poisoned, it returns a fake IP address controlled by an attacker. The user then visits the wrong website without knowing it. This can lead to stolen information or malware. The process starts with the user typing a website, sending a DNS query, the server checking its cache, and if poisoned, returning a fake IP. The user connects to the fake site, thinking it is the real one. To prevent this, DNS servers must be secured and technologies like DNSSEC used to verify responses.