What's Normal: New uses of DNS, Discovery of Designated Resolvers (DDR), (Tue, Nov 7th)

Collecting and analyzing DNS logs should be at the top of your agenda regarding network monitoring. Everything that happens on the network tends to be reflected in DNS, and events that do not correlate with DNS are often suspect themselves. For example, if a host connects to an IP address directly without first receiving it as a DNS response. But in recent years, DNS has moved more and more to encrypted channels. Starting with DNS over TLS (DoT), DNS over …

collecting ddr discovery dns events host logs monitoring network network monitoring normal nov