# Q3(c) · DNS cache inference

Subject: Computer Networks

Exam: TEE

Reader: https://deep-learning-study-room.vercel.app/cn/#tee/papers/paper-2023-ai-partial/q3c

Canonical: https://deep-learning-study-room.vercel.app/read/cn/tee/papers/paper-2023-ai-partial--q3c/

Exact historical variant. Current-syllabus questions solved; excluded topics and source limitations stated.

### Q3(c). Can an ordinary user, without access to the DNS cache as administrator, infer whether an external website was visited a few seconds ago? Explain a possible method and its limitations. [5 marks]

### Answer

A rough method is to query the local resolver for a site and compare response time or remaining TTL with a likely cold lookup. A cached answer can be returned without an external lookup, so a fast response or an aged TTL may suggest a previous resolution.

This is not proof of a visit a few seconds ago: cached records may come from another user, background requests, prefetching or older use; TTLs differ and network timing is noisy. A visit may also use an already cached browser/OS answer without contacting that DNS server. State “possible weak inference”, not a certain browsing history.