Dns Spoofing - HP FlexNetwork MSR2003 Configuration Manual

1. A DNS client considers the DNS proxy as the DNS server, and sends a DNS request to the
DNS proxy. The destination address of the request is the IP address of the DNS proxy.
2. The DNS proxy searches the local static domain name resolution table and dynamic domain
name resolution cache after receiving the request. If the requested information is found, the
DNS proxy returns a DNS reply to the client.
3. If the requested information is not found, the DNS proxy sends the request to the designated
DNS server for domain name resolution.
4. After receiving a reply from the DNS server, the DNS proxy records the IP address-to-domain
name mapping and forwards the reply to the DNS client.
If no DNS server is designated or no route is available to the designated DNS server, the DNS proxy
does not forward DNS requests.

DNS spoofing

DNS spoofing is applied to the dial-up network, as shown in
•
The device connects to a PSTN/ISDN network through a dial-up interface. The device triggers
the establishment of a dial-up connection only when packets are to be forwarded through the
dial-up interface.
•
The device acts as a DNS proxy and is specified as a DNS server on the hosts. After the dial-up
connection is established, the device dynamically obtains the DNS server address through
DHCP or another autoconfiguration mechanism.
Figure 41 DNS spoofing application
The DNS proxy does not have the DNS server address or cannot reach the DNS server after startup.
A host accesses the HTTP server in the following steps:
1. The host sends a DNS request to the device to resolve the domain name of the HTTP server
into an IP address.
2. Upon receiving the request, the device searches the local static and dynamic DNS entries for a
match. Because no match is found, the device spoofs the host by replying a configured IP
address. The device must have a route to the IP address with the dial-up interface as the output
interface.
The IP address configured for DNS spoofing is not the actual IP address of the requested
domain name. Therefore, the TTL field is set to 0 in the DNS reply. When the DNS client
receives the reply, it creates a DNS entry and ages it out immediately.
3. Upon receiving the reply, the host sends an HTTP request to the replied IP address.
4. When forwarding the HTTP request through the dial-up interface, the device performs the
following operations:
Establishes a dial-up connection with the network.
Figure
97
41.