version.bind/TXT

[Joseph S D Yao]

On Tue, May 01, 2001 at 05:42:40PM -0000, syn uw wrote:
...
> Apr 30 18:06:14 kyrandia named[24200]: XX /200.204.127.114/VERSION.BIND/TXT
> Apr 30 21:58:56 kyrandia named[24200]: XX /203.13.169.165/version.bind/TXT
> May  1 18:20:09 kyrandia named[24200]: XX /200.61.71.26/version.bind/TXT
> 
> My question is: does anybody know if that's normal ? If yes what is it 
> exactly, is it BIND itself generating that ? What I think is that I am maybe 
> being probed by some malicious software which tryes to detect my BIND 
> version. What do you think ?

Do a

	dig chaos txt version.bind

or

	nslookup -class=chaos -type=txt version.bind

to see your own name server's version.  This is not necessarily
malicious, but may be.  To target a remote server, add the remote
server as another argument to 'nslookup', or after an "@" sign as
another argument to 'dig'.

-- 
Joe Yao				jsdy at cospo.osis.gov - Joseph S. D. Yao
OSIS/COSPO Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.