Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have just read this article on DNS cache poisoning, and while I understand it, am I right in saying that DNS cache poisoning is impossible when the server is behind a router using either an address or port restricted cone NAT?

share|improve this question
up vote 7 down vote accepted


In a cache poisoning attack, the attacker spoofs a response from the true name server. A forged response that successfully poisons a recurser's cache has the correct source IP, the correct port information, and the correct query ID - the NAT device will forward such a packet on to the server.

Source port randomization on the NAT device (instead of having every query just come from UDP 53) would provide some additional complexity for an attacker to overcome, but in an attack where you're forcing the NAT translation to stay in place with constant queries, the translation will stay in place - the source port would only need to be guessed once, instead of for every single query.

Source port randomization on the recurser's DNS process is pretty much a necessity for semi-decent protection against this attack.

share|improve this answer
Ah, so it is very possible to forge the source IP and port as the recurser never needs to acknowledge it recieved the packet as DNS uses UDP... Thank you. – R4D4 Oct 22 '11 at 23:19
Nope no acknowledging. DNS works in a very simple manner so it can be fast. You send one packet query you get one packet response (in most cases). – Radek Hladík Oct 22 '11 at 23:25

Basically as I understand the attack it works by providing the false response faster than the real server is providing the correct answer. The problem is that there are some things that the attacker does not know unless he get access to the query packet like port number. This means that the attacker needs to try all the possible combinations. Some design flaws like single or sequential source port makes it much less combinations to try.

The problem with firewall is that the firewall needs to pass in the correct response back to the query originator. So if it is doing NAT and/or stateless firewalling it will record the outgoing DNS query packet ports into NAT and/or connections table. When the response packet comes and matches the ports it will be passed or deNATed no matter if it is the real or the phony one.

share|improve this answer

Well it depends, if you can trust anyone you send a packet too at first, probably yes. But else it is possible, because he would still be able to send you packets with the fraudulent ip. The IP he will be sending from will be an IP you can communicate with, the malicious IP will just be in the content of the packet. (If I understand this correctly)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.