Even after showing /etc/hosts and named.conf it’s possible to deceit the victim if there is any rootkit in place! Personally, I would connect to the same LAN as the attacker and eavesdrop (sniff) him to see where the packets are really going.
Hata baada ya kuonyesha / nk / majeshi na named.conf inawezekana udanganyifu mwathirika kama kuna yoyote rootkit katika nafasi! Binafsi, Napenda kuungana na LAN huo kama mshambulizi na eavesdrop (vuta) kwake kuona ambapo pakiti ni kweli kwenda.