Patent ID: 8910280

Claim:
A method comprising: monitoring, at an inline apparatus, response packets utilizing a detection algorithm; detecting, at the inline apparatus, a domain name system cache poisoning attack utilizing the detection algorithm, wherein detecting the domain name system cache poisoning attack comprises listening to a response packet of the response packets; determining that the response packet arrives within a time window; and in response to determining that the response packet arrives within the time window, determining if the response packet comprises a domain name system error, in response to determining that the response packet does not comprise the domain name system error, storing data contained within an additional section of the response packet in a first table, storing data contained within an answer section of the response packet in a second table, and in response to determining that the response packet comprises the domain name system error, storing data contained within a header section and a question section of the response packet in a third table; and confirming the domain name system cache poisoning attack by examining historical response data and current response data obtained from a reliable source.