A system for fingerprinting operating system and/or other client software incorporates a server executing multiple logical servers, a data storage unit and DNS server. Upon receiving a client DNS query for resolving a domain name of a logical server, the DNS server provides multiple IP addresses for the server domain name. The order of the multiple IP addresses provided by the DNS server is changed in each DNS server response. The server then receives a request from the client using one of the IP addresses provided to the client by the DNS server. The information on the original order of the multiple IP addresses provided to the client by the DNS server and the one IP address chosen by the client for accessing the server are stored in the data storage. After accumulation of sufficient statistics, the stored data is analyzed and the client software fingerprint is created based thereon.
