DNS Resolvers

Overview

Evidence: DNS Resolvers Description: Collect DNS resolvers Category: Network Platform: AIX Short Name: dns Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

DNS resolvers on AIX (Advanced Interactive eXecutive) systems provide configuration information about how the system resolves domain names to IP addresses. This data is essential for understanding network configuration, detecting DNS-related security incidents, and investigating network connectivity issues. DNS resolver configuration affects how applications and services resolve hostnames on AIX systems.

Data Collected

This collector gathers structured data about DNS resolvers.

DNS Resolvers Data

Field	Description	Example
ID	Primary key (auto-increment)	1
Type	DNS resolver type	nameserver
Address	DNS server address	8.8.8.8
Netmask	Network mask	32
OptionsStr	DNS options string	edns0 trust-ad

Collection Method

This collector parses the necessary data from DNS configuration files.

This collector collects files from the following locations:

• /etc/resolv.conf

Usage

This evidence is crucial for forensic investigations as it provides information about DNS configuration and network resolution settings on AIX systems. It helps investigators understand network configuration, detect DNS-related attacks, and investigate network connectivity issues. The data can reveal DNS server configurations, search domains, and resolution options. Analysts can use this information to identify DNS misconfigurations, trace network resolution patterns, and assess AIX system network security posture.

Notes

This data may contain sensitive information that should be handled according to data protection requirements. Ensure proper chain of custody is maintained during collection and analysis.