> the only data is domain name, record and the incoming ip
Other data that can be logged:
- timestamp - this can be very revealing when correlated with other datasets.j
- ASN - can sometimes act like fingerprint on it's own, and assists in correlating other data (e.g. the timestamp)
- any identifiable variation in the structure or behavior between different DNS resolver implementations. See nmap's "-O" option that detects the OS from the TCP/IP protocol implementation.
Other data that can be logged:
- timestamp - this can be very revealing when correlated with other datasets.j
- ASN - can sometimes act like fingerprint on it's own, and assists in correlating other data (e.g. the timestamp)
- any identifiable variation in the structure or behavior between different DNS resolver implementations. See nmap's "-O" option that detects the OS from the TCP/IP protocol implementation.