take a look at yamas' source, there is DNS spoofing. It should help you understand. http://comax.fr/yamas.php http://pastebin.com/7TGfjJuy If even with the link you provided, and the search you appear to have done, you still can't figure it out, then maybe yuou should try and learn the basics before trying this kind of attack.