Dns Spoofing - HP 3600 v2 Series Configuration Manual

A DNS proxy operates as follows:
A DNS client considers the DNS proxy as the DNS server, and sends a DNS request to the DNS
1.
proxy. The destination address of the request is the IP address of the DNS proxy.
The DNS proxy searches the local static domain name resolution table and dynamic domain name
2.
resolution table after receiving the request. If the requested information is found, the DNS proxy
returns a DNS reply to the client.
If the requested information is not found, the DNS proxy sends the request to the designated DNS
3.
server for domain name resolution.
After receiving a reply from the DNS server, the DNS proxy records the IP address-to-domain name
4.
mapping and forwards the reply to the DNS client.
With no DNS server or route to a DNS server specified, the DNS proxy does not forward DNS requests,
or answer requests from the DNS clients.

DNS spoofing

DNS spoofing is applied to the dial-up network, as shown in
The device connects to the PSTN/ISDN network through a dial-up interface and triggers the
•
establishment of a dial-up connection only when packets are to be forwarded through the dial-up
interface.
• The device serves as a DNS proxy and is specified as a DNS server on the hosts. After the dial-up
connection is established through the dial-up interface, the device dynamically obtains the DNS
server address through DHCP or other autoconfiguration mechanisms.
Figure 41 Application of DNS spoofing
Without DNS spoofing enabled, the device forwards the DNS requests received from the hosts to the
DNS server, if it cannot find a match in the local domain name resolution table. However, without any
dial-up connection established, the device cannot obtain the DNS server address, so it cannot forward
or answer the requests from the clients. The domain name cannot be resolved and no traffic triggers the
establishment of a dial-up connection.
DNS spoofing can solve this problem. DNS spoofing enables the device to reply the DNS client with a
configured IP address when the device does not have a DNS server address or route to a DNS server.
Subsequent packets sent by the DNS client trigger the establishment of a dial-up connection with the
network.
In the network of Figure 41, a host accesses the HTTP server in following these steps:
Figure
89
41.