"Brad" == Brad Knowles <brad@stop.mail-abuse.org> writes:
# perl fpdns.pl udns1.ultradns.net udns2.ultradns.net fingerprint (udns1.ultradns.net, 204.69.234.1): UltraDNS v2.7.0.2 -- 2.7.3 fingerprint (udns2.ultradns.net, 204.74.101.1): UltraDNS v2.7.0.2 -- 2.7.3
Brad> That doesn't necessarily mean anything. If they had Brad> been a large customer of Nominum, they could easily be Brad> running code that generated a different fingerprint. Nope. Roy and Jakob's tool can already fingerprint Nominum's DNS implementations. And just about anyone else's for that matter. Besides, I very much doubt if anyone would create a code fork and all the aggravation flowing from that -- support overheads, regression testing, documentation, software maintenance, etc -- just to confuse a fingerprinting tool. And of course the tool could easily be updated to take account of any obfuscation like that. Why would anyone choose to enter that zero-sum game? Brad> When it comes to this sort of thing, I trust Brad> information from people who have extensive background Brad> information (such as Jim) than I do fingerprints. You'll be much better off to trust this fingerprinting tool than depend on my memory. :-)