DNS Spoof??

[bodezafa]

What is a dns spoof?? Cassnet is my isp and black ice picked this up. Its like the third time, should I worry?

[R0BB23]

well dns is the ip i use to connect to my isp.

cause i have pppoe adsl and my ip rotates.

so that might help you but i dont know exactly what that is.

[Warlord2]

correct me if Im wrong anyone but isnt dns the ip that connects you to your providers?

like I have cable so everyone on a block or so has the same dns and that branches out to what your IP is

so you may not be the one getting all those attacks but the people in your area (or the people on your dns)

there nothing to worry about=]

[R0BB23]

yes i believe that might be true.

[UnseenMenace]

DNS is service used in conjunction with the TCP/IP protocol for locating other devices on a network. DNS is a hierarchical data structure (a directory service) that enables the use of friendly names on a network, rather than using IP addresses. It provides a means for translating IP addresses into easier to remember words or names.

It is also Known As: Domain Name System

[UnseenMenace]

When visiting websites, such as http://www.overclockers.com, the system must first resolve the name into an IP address using DNS. This is similar to how you must lookup someones name in the phone book in order to dial their telephone number.

There exists a hacker technique whereby they can sometimes force a duplicate reply to the DNS lookup. Using the phone book analogy, it is similar to calling 411/information for somebody's number and getting back two replies. Imagine a hacker breaking into the phone system such that the first number you heard was to the hacker. The hacker who broke into the telephone system might use this technique to redirect people buying with credit cards to his own phone number, then pretend to be the real vendor, then steal the credit card numbers. In much the same way, hackers use this DNS spoof in order to redirect people to their own website.

False Positives when using BlackICE Defender

This symptom is caused when two different copies of a DNS response have been received. BlackICE users often see such behavior from ISPs. Some ISPs attempt to re-direct users through their own caching servers. Therefore, this "spoof" symptom doesn't actually indicate a hostile attack.

[bodezafa]

Originally posted by UnseenMenace
When visiting websites, such as http://www.overclockers.com, the system must first resolve the name into an IP address using DNS. This is similar to how you must lookup someones name in the phone book in order to dial their telephone number.

There exists a hacker technique whereby they can sometimes force a duplicate reply to the DNS lookup. Using the phone book analogy, it is similar to calling 411/information for somebody's number and getting back two replies. Imagine a hacker breaking into the phone system such that the first number you heard was to the hacker. The hacker who broke into the telephone system might use this technique to redirect people buying with credit cards to his own phone number, then pretend to be the real vendor, then steal the credit card numbers. In much the same way, hackers use this DNS spoof in order to redirect people to their own website.

False Positives when using BlackICE Defender

This symptom is caused when two different copies of a DNS response have been received. BlackICE users often see such behavior from ISPs. Some ISPs attempt to re-direct users through their own caching servers. Therefore, this "spoof" symptom doesn't actually indicate a hostile attack.

Thats what i got from black ice.
just wanted to know if there is anything to worry about.
When I had Mediaone Roadrunner this never happend, but now with cassnet it happens all the time.
Thanx all for your help!