version.bind/TXT
tmaestas at dnsconsultants.com
tmaestas at dnsconsultants.com
Tue May 1 18:28:11 UTC 2001
No, BIND is not generating this, as you can see from
the source IP of the query. This is someone querying
your BIND server for it's version string. What is returned
to this query can be controlled by the version statement
in the options section of your named.conf
-Tim
On Tue, 1 May 2001, syn uw wrote:
>
> Hello !
>
> I am logging all bind queries using the query-log option and in my log file
> I saw some curious entries which are the following:
>
> Apr 30 18:06:14 kyrandia named[24200]: XX /200.204.127.114/VERSION.BIND/TXT
> Apr 30 21:58:56 kyrandia named[24200]: XX /203.13.169.165/version.bind/TXT
> May 1 18:20:09 kyrandia named[24200]: XX /200.61.71.26/version.bind/TXT
>
> My question is: does anybody know if that's normal ? If yes what is it
> exactly, is it BIND itself generating that ? What I think is that I am maybe
> being probed by some malicious software which tryes to detect my BIND
> version. What do you think ?
>
> Thanks for the comments.
>
> Regards,
> Marc
>
>
> _________________________________________________________________________
> Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.
>
>
More information about the bind-users
mailing list