Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As I understand, ARP spoofing can only be done on the LAN-side of the router?

DNS spoofing, can that be done either side of the router?

In order to do DNS spoofing, do you need to perform ARP spoofing first?

share|improve this question
add comment

2 Answers

The answer is NO. If the attacker can use ARP spoofing to perform a MITM attack against your victim then DNS spoofing doesn't help, the attacker already owns all of the traffic.

You can perform a MITM attack by influencing DNS in other ways. DNS Cache Poising is a very serious attack vector. (If you call this the "Kaminsky attack" you will not be taken seriously.)

On the open Internet BGP attacks is used to perform a MITM attacks. China used this attack to hijack 15% of Internet.

share|improve this answer
    
How can a user limit being DNS-spoofed against? –  Ian Dec 24 '11 at 17:34
    
@Thomas ????? Dude you need to read a lot more. And no, without https a user has no protection against MITM attacks. –  Rook Dec 24 '11 at 18:23
add comment

ARP packets are layer 2, which is to say, they are never routed. They only have meaning and context in a network configuration where two devices can both 'see' the same wire.

DNS packets are layer 3 (usually UDP/IP, sometimes TCP/IP) and are routable. So yes, spoofing for DNS can be done anywhere as long as it eventually routes the packet to the target machine.

ARP spoofing is not required for DNS spoofing, and in general a DNS spoof attack will not involve ARP spoofing. Since DNS is usually over UDP, packets can be spoofed without the complexity of ARP spoofing - you just need to fool the application layer, not the IP stack or state. ARP spoofing is used to fooling the network layer, so that (for example) a TCP handshake can be made between an imposter machine and it's victim.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.