DNS poisoning in Computer Networks - Step-by-Step Execution

Concept Flow - DNS poisoning

User types website name

↓

DNS query sent to DNS server

↓

DNS server checks cache

↓

Is cache poisoned?

Yes→Return fake IP address

↓

User visits wrong site

↓

Return correct IP address

↓

User visits correct site

This flow shows how a DNS query can be intercepted if the DNS server cache is poisoned, causing the user to be sent to a fake website.

Execution Sample

Computer Networks

User types 'example.com'
DNS query sent to DNS server
DNS server returns IP address
User connects to IP address

This shows the normal DNS lookup process where the user gets the correct IP address for a website.

Analysis Table

Step	Action	DNS Server Cache Status	IP Address Returned	User Outcome
1	User types 'example.com'	N/A	N/A	N/A
2	DNS query sent to DNS server	Cache checked	N/A	N/A
3	Cache poisoned?	Yes	Fake IP (attacker site)	User visits fake site
4	User connects to IP	N/A	Fake IP (attacker site)	User at attacker site
5	End	N/A	N/A	User misled by fake site

💡 Execution stops because DNS server returns fake IP due to cache poisoning.

State Tracker

Variable	Start	After Step 2	After Step 3	Final
DNS Server Cache	Clean	Checked	Poisoned with fake IP	Poisoned with fake IP
IP Address Returned	None	None	Fake IP	Fake IP
User Destination	None	None	Fake site	Fake site

Key Insights - 3 Insights

Why does the DNS server return a fake IP address?

Because the DNS server cache was poisoned with a fake IP, as shown in execution_table step 3.

Does the user know they are visiting a fake site?

No, the user trusts the IP returned by the DNS server and is unknowingly sent to the fake site (execution_table step 4).

What triggers the DNS server to return the fake IP?

The DNS server cache being poisoned before the query is processed, shown in variable_tracker for DNS Server Cache after step 3.

Visual Quiz - 3 Questions

Look at the execution_table at step 3, what IP address does the DNS server return?

A No IP address

B Correct IP address

C Fake IP address

D User's IP address

💡 Hint

Check the 'IP Address Returned' column at step 3 in execution_table.

At which step does the user get redirected to the fake website?

A Step 4

B Step 3

C Step 2

D Step 5

💡 Hint

Look at the 'User Outcome' column in execution_table for when the user connects to the IP.

If the DNS server cache was not poisoned, what would change in the execution_table?

A User would visit fake site at step 4

B IP Address Returned would be correct IP at step 3

C DNS query would not be sent

D User types a different website

💡 Hint

Refer to the 'DNS Server Cache Status' and 'IP Address Returned' columns in execution_table.

Concept Snapshot

DNS poisoning tricks a DNS server into giving a fake IP address.
User types a website name and sends a DNS query.
If the DNS cache is poisoned, the server returns a wrong IP.
User unknowingly visits a fake, possibly harmful site.
Protect by securing DNS servers and using DNSSEC.

Full Transcript

DNS poisoning happens when a DNS server's cache is corrupted to return a fake IP address for a website. When a user types a website name, their computer asks the DNS server for the IP address. If the DNS server's cache is poisoned, it returns a fake IP address controlled by an attacker. The user then visits the wrong website without knowing it. This can lead to stolen information or malware. The process starts with the user typing a website, sending a DNS query, the server checking its cache, and if poisoned, returning a fake IP. The user connects to the fake site, thinking it is the real one. To prevent this, DNS servers must be secured and technologies like DNSSEC used to verify responses.

Practice

1. What is the main goal of DNS poisoning in computer networks?

easy

A. To block access to certain websites

B. To redirect users to fake websites by giving wrong IP addresses

C. To encrypt DNS queries for security

D. To speed up the DNS lookup process

Solution

1. Step 1: Understand DNS function

   DNS translates website names into IP addresses so computers can find websites.

2. Step 2: Identify DNS poisoning effect

   DNS poisoning gives wrong IP addresses, sending users to fake sites instead of real ones.

3. Final Answer:

   To redirect users to fake websites by giving wrong IP addresses -> Option B

4. Quick Check:

   DNS poisoning = Redirect to fake sites [OK]

Hint: DNS poisoning tricks DNS to give wrong addresses [OK]

Common Mistakes:

• Thinking DNS poisoning speeds up browsing
• Confusing DNS poisoning with encryption
• Believing it blocks websites instead of redirecting

2. Which of the following is a correct way to describe DNS poisoning?

easy

A. It modifies DNS cache with false information

B. It encrypts DNS queries to protect privacy

C. It speeds up DNS resolution by caching

D. It blocks DNS requests from unknown sources

Solution

1. Step 1: Recall DNS poisoning mechanism

   DNS poisoning involves changing DNS cache entries to wrong IP addresses.

2. Step 2: Match description to options

   Only It modifies DNS cache with false information correctly states DNS poisoning modifies DNS cache with false info.

3. Final Answer:

   It modifies DNS cache with false information -> Option A

4. Quick Check:

   DNS poisoning = false DNS cache entries [OK]

Hint: DNS poisoning changes DNS cache to wrong info [OK]

Common Mistakes:

• Confusing poisoning with encryption
• Thinking it speeds up DNS
• Assuming it blocks requests

3. Consider this scenario: A user tries to visit example.com. Due to DNS poisoning, the DNS cache returns the IP 192.0.2.123 instead of the real IP 93.184.216.34. What is the likely result?

medium

A. The user is redirected to a fake website at IP 192.0.2.123

B. The DNS query fails and the website doesn't load

C. The user reaches the real example.com website safely

D. The user's browser automatically blocks the connection

Solution

1. Step 1: Understand DNS poisoning effect on IP

   The DNS cache gives a wrong IP (192.0.2.123) instead of the real one (93.184.216.34).

2. Step 2: Predict user experience

   The user is sent to the wrong IP, likely a fake website pretending to be example.com.

3. Final Answer:

   The user is redirected to a fake website at IP 192.0.2.123 -> Option A

4. Quick Check:

   Wrong IP from DNS = fake site visit [OK]

Hint: Wrong IP from DNS means fake site shown [OK]

Common Mistakes:

• Assuming user reaches real site
• Thinking DNS query fails
• Believing browser blocks automatically

4. A network admin notices users are being redirected to suspicious sites. They suspect DNS poisoning. Which action will help fix this issue?

medium

A. Turn off the internet connection temporarily

B. Disable the firewall to allow all traffic

C. Change all user passwords immediately

D. Clear the DNS cache on affected devices and servers

Solution

1. Step 1: Identify how DNS poisoning affects devices

   DNS poisoning corrupts DNS cache with wrong IP addresses causing redirection.

2. Step 2: Choose corrective action

   Clearing DNS cache removes false entries, restoring correct address resolution.

3. Final Answer:

   Clear the DNS cache on affected devices and servers -> Option D

4. Quick Check:

   Fix DNS poisoning by clearing DNS cache [OK]

Hint: Clear DNS cache to remove poisoned entries [OK]

Common Mistakes:

• Disabling firewall worsens security
• Changing passwords doesn't fix DNS
• Turning off internet is impractical

5. A company wants to protect its users from DNS poisoning attacks. Which combined approach is best to reduce risk?

hard

A. Manually edit hosts files on all user devices

B. Only use public Wi-Fi networks and disable firewalls

C. Use DNSSEC to verify DNS data and configure trusted DNS servers

D. Rely solely on antivirus software for protection

Solution

1. Step 1: Understand DNSSEC and trusted DNS servers

   DNSSEC adds digital signatures to DNS data to verify authenticity. Trusted DNS servers reduce risk of poisoning.

2. Step 2: Evaluate options for protection

   Use DNSSEC to verify DNS data and configure trusted DNS servers combines verification and trusted sources, effectively reducing DNS poisoning risk.

3. Final Answer:

   Use DNSSEC to verify DNS data and configure trusted DNS servers -> Option C

4. Quick Check:

   DNSSEC + trusted DNS = strong DNS poisoning defense [OK]

Hint: Use DNSSEC and trusted servers to stop poisoning [OK]

Common Mistakes:

• Thinking public Wi-Fi is safe
• Manually editing hosts is impractical
• Relying only on antivirus misses DNS attacks