Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

my isp has spoofed dns ips(like so when i request for some names(like it sends me some wrong ip addresses. this is the situation:


Non-authoritative answer:

when i encrypt my dns queries it's just fine. is it called 'dns hijacking' or dns cache poisoning?

share|improve this question
What your ISP is doing is exactly what "dns hijacking" is. I would use an alternative DNS provider to solve that problem. – Ramhound Nov 26 '12 at 12:55

It's probably cache poisoning - that's where someone sends lots of DNS responses to a server hoping to have one of them accepted instead of a valid response from an upstream server. Then for a while the DNS server will serve that spoofed response from its own cache.

Have a read here for more info:

share|improve this answer
and what is exactly the dns hijacking? – sia Oct 17 '12 at 21:09
Well - according to Wikipedia ;) it's this: "DNS hijacking or DNS redirection is the practice of subverting the resolution of Domain Name System (DNS) queries. This can be achieved by malware that overrides a computer's TCP/IP configuration to point at a rogue DNS server under the control of an attacker, or through modifying the behaviour of a trusted DNS server so that it does not comply with internet standards." – ed. Oct 17 '12 at 21:18

Actually in this case it's DNS hijacking, not DNS cache poisoning.

The difference between DNS hijacking and DNS poisoning is who the responder of the DNS request is.

In the case of DNS hijacking, your machine makes a request to an upstream DNS provider asking "where is" and it responds " is at" without bothering to find out where it actually lives. This is in contrast with a normal DNS request where the DNS server would either query the real address from its cache or an upstream provider and then tell you with whom you need to connect to reach

DNS cache poisoning is where someone else's machine sends a request to your upstream provider asking "where is". When that machine requests from its upstream provider, the attacker then tries to "race" the DNS response. So the poisoner effectively asks "where is" and then throws lots of " is at" at your upstream DNS provider. If one of them "sticks", your upstream DNS will think that is at and will cache the response.

Now, when you make a request to your upstream DNS provider, instead of it asking its upstream provider, it "knows" (i.e. has cached) that is at - a domain owned by the attacker.

But in your particular case, you're not being attacked. Your ISP is deliberately misreporting where is in order to redirect you to an internet gateway portal, rather than to steal your private information or hijack your cookies. Alternatively (since we're talking about youtube), your ISP might have an agreement with Google to host some content geographically closer to you to reduce the load on the ISP, which might require your ISP to "spoof" youtube to a false address within the ISP network.

So in summary, you're being DNS hijacked, but almost certainly not maliciously.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .