As I understand, ARP spoofing can only be done on the LAN-side of the router?

DNS spoofing, can that be done either side of the router?

In order to do DNS spoofing, do you need to perform ARP spoofing first?


ARP packets are layer 2, which is to say, they are never routed. They only have meaning and context in a network configuration where two devices can both 'see' the same wire.

DNS packets are layer 3 (usually UDP/IP, sometimes TCP/IP) and are routable. So yes, spoofing for DNS can be done anywhere as long as it eventually routes the packet to the target machine.

ARP spoofing is not required for DNS spoofing, and in general a DNS spoof attack will not involve ARP spoofing. Since DNS is usually over UDP, packets can be spoofed without the complexity of ARP spoofing - you just need to fool the application layer, not the IP stack or state. ARP spoofing is used to fooling the network layer, so that (for example) a TCP handshake can be made between an imposter machine and it's victim.

|improve this answer|||||

The answer is NO. If the attacker can use ARP spoofing to perform a MITM attack against your victim then DNS spoofing doesn't help, the attacker already owns all of the traffic.

You can perform a MITM attack by influencing DNS in other ways. DNS Cache Poising is a very serious attack vector. (If you call this the "Kaminsky attack" you will not be taken seriously.)

On the open Internet BGP attacks is used to perform a MITM attacks. China used this attack to hijack 15% of Internet.

|improve this answer|||||
  • How can a user limit being DNS-spoofed against? – Ian Dec 24 '11 at 17:34
  • @Thomas ????? Dude you need to read a lot more. And no, without https a user has no protection against MITM attacks. – rook Dec 24 '11 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.