Ettercap/ettercap — pull request #219 by koeppea (2013-05-01 18:21:50+00:00)
Title: dns_spoof plugin: add support for negative-cache replies

Updates the dns_spoof plugin with the capability to spoof negative-cache replies.
Negative-cache replies are sent when a host ist being queried with A and AAAA but has only a valid reply for one of the both protocol families.

For the other query, a SOA record is sent as a authority resource record instead of a answer resource record. The SOA authority record has the effect to stop processing of this section immediately.

This way, ettercap can suppress either the IPv4 or IPv6 address of being used without any notice or error on the client or server side.