DNS Query ID Attack

Attacker spoofs DNS replies
DNS cache poisoning
Blind attack requires guessing
16 bit DNS request ID
16 bit source port