When a victim is accessing http://192.168.21.56/
there's no DNS queries involved, hence no DNS poisoning. DNS gives IP addresses based on hostnames, and that's already an IP address.
DNS (cache) poisoning refers to a specific attack where a resolver is tricked to cache fake records. Some resolvers will cache anything they get despite they didn't ask for it. These could be totally faked responses or smuggled as additional records within a response to an actual query.
Probably more relevant for your use case would be DNS hijacking with a fake resolver of some kind of man-in-the-middle attack, which could involve DNS spoofing or concentrate on modifying HTTP responses.