I was reading an e-book about different types of attacks and found this:
A skilled hacker can intercept DNS replies from servers and replace the IP addresses for the requested names with addresses of machines that the hacker controls, thus providing an easy method for ongoing session attacks.
Does this mean that as soon as the attacker intercepts the packets, software replaces the addresses or does the attacker have to do it manually. If the latter is true, then can the victim tell that they are being hijacked from the delay?