Spoofing, DNS Poisoning and Sniffing Defense

What it is

Spoofing means forging an identity: a MAC address, an IP address, a DNS answer or a name. DNS poisoning forges the answer to a name lookup so victims reach the wrong server.

The page then closes the sniffing topic: the tools used to capture traffic, the controls that make capture useless, and the techniques that detect a sniffer on the network.

How it works

Spoofing attacks

IP spoofing cannot easily complete a normal TCP connection because the replies go to the forged address, so it suits one way attacks such as floods and reflection. Ingress filtering drops packets arriving from outside with internal source addresses, and egress filtering drops outgoing packets whose source is not yours.

DNS poisoning

DNS poisoning (cache poisoning) places false records in a resolver's cache or in a client's lookup path. Every user of that resolver is then sent to the attacker's address until the record expires.

A forged response is accepted only if it matches the query, which is why unpredictable transaction IDs and random source ports make cache poisoning much harder. The usual goal is a fake login page or malware download served under a trusted name.

Countermeasures:

• DNSSEC, which signs records so a resolver can verify them.
• Randomized source ports and transaction IDs, patched resolvers and limiting recursion to your own clients.
• DNS filtering, and certificate warnings that users do not click through.
• Secure the local network (DAI, DHCP snooping), since many intranet attacks begin with ARP poisoning.

Sniffing tools

In Wireshark, capture filters (applied before capture) and display filters (applied afterwards) are different. A display filter such as tcp.port == 80 shows only traffic on port 80, and arp shows ARP packets. Wireshark also reassembles streams so a whole conversation can be read.

Sniffing countermeasures

• Use encrypted protocols: HTTPS, SSH, SFTP, IMAPS, SNMPv3, and VPNs or IPsec across untrusted links.
• Use switches rather than hubs, and enable port security, DHCP snooping and DAI.
• Use static ARP entries for critical hosts, and disable unused ports.
• Restrict physical access and use network access control (802.1X).
• Use strong wireless encryption, and encrypt email and chat.

Sniffing detection techniques

A sniffer in promiscuous mode behaves slightly differently from a normal host, and that can be tested.

• Ping method: send a ping to the suspect IP with a wrong MAC address. Only a card in promiscuous mode may answer, because the stack accepts the frame.
• ARP method: send an ARP request to the suspect with an unusual non broadcast destination. A promiscuous card may respond.
• DNS method: a sniffer that resolves addresses to names generates reverse DNS lookups, which can be monitored.
• Latency method: a host that processes all traffic may respond more slowly under load.
• Nmap: the sniffer-detect script (run with --script=sniffer-detect) checks for promiscuous mode on the local network.
• Network monitoring: watch for MAC addresses changing, many ARP replies and unexpected switch port mirroring.

A worked example

Users reach a bank page that looks right, but the certificate warning appears and the DNS answer for the bank name points to an unexpected address. The resolver cache was poisoned. DNSSEC validation, patched resolvers with random ports, and refusing the certificate prevent damage.

How the exam asks about this

• "Which technology signs DNS records to prevent forged answers?" -> DNSSEC.
• "Which filtering drops packets that arrive from outside carrying an internal source address?" -> Ingress filtering.
• "Which tool is a graphical packet analyzer using capture and display filters?" -> Wireshark.