DNS Watchdog for Windows is a native PowerShell script that leverages pktmon, the built-in Windows packet capture utility, to monitor DNS traffic on a host for indications of DNS poisoning or spoofing. It captures DNS queries and responses at the OS networking stack level, parsing raw pcapng packets to detect conflicting DNS answers to the same query, responses from unconfigured DNS servers, answers without matching queries, and changes in the default gateway's MAC address that may indicate ARP spoofing. The script runs in short capture windows, deduplicates repeated packets, and logs alerts with technical details and plain-language explanations. It requires elevated PowerShell and recent Windows builds supporting pktmon pcapng conversion. Limitations include heuristic detection with potential false positives, gaps between capture windows, and inability to detect poisoning occurring solely within remote resolvers.

This tool helps detect DNS poisoning attempts on the local machine by identifying conflicting or suspicious DNS responses and ARP spoofing events that could lead to DNS tampering. It does not itself represent a vulnerability or exploit but provides monitoring capability to alert defenders to potential DNS-based attacks targeting the host. Detection can enable timely investigation and response to DNS spoofing threats.

This is a detection tool rather than a vulnerability requiring patching. No official patch or fix is applicable. Users should run the script with administrative privileges on supported Windows versions to monitor DNS traffic for poisoning attempts. Because it is heuristic, users should interpret alerts carefully and consider repeated or clustered alerts as more meaningful. No vendor advisory or official remediation applies.