version.bind/TXT

tmaestas at dnsconsultants.com tmaestas at dnsconsultants.com
Tue May 1 18:28:11 UTC 2001



	No, BIND is not generating this, as you can see from
	the source IP of the query.  This is someone querying
	your BIND server for it's version string.  What is returned
	to this query can be controlled by the version statement
	in the options section of your named.conf

-Tim


On Tue, 1 May 2001, syn uw wrote:

> 
> Hello !
> 
> I am logging all bind queries using the query-log option and in my log file 
> I saw some curious entries which are the following:
> 
> Apr 30 18:06:14 kyrandia named[24200]: XX /200.204.127.114/VERSION.BIND/TXT
> Apr 30 21:58:56 kyrandia named[24200]: XX /203.13.169.165/version.bind/TXT
> May  1 18:20:09 kyrandia named[24200]: XX /200.61.71.26/version.bind/TXT
> 
> My question is: does anybody know if that's normal ? If yes what is it 
> exactly, is it BIND itself generating that ? What I think is that I am maybe 
> being probed by some malicious software which tryes to detect my BIND 
> version. What do you think ?
> 
> Thanks for the comments.
> 
> Regards,
> Marc
> 
> 
> _________________________________________________________________________
> Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.
> 
> 



More information about the bind-users mailing list