Re: Microsoft version.binding us now?

[bejtlich () ALTAVISTA NET (Richard Bejtlich)]

Hello,

Great work tracking this 3DNS signature!  When I looked at 
3DNS' F5 signatures last year, I found them using null 64 
byte SYN packets to local name servers to try to test 
latency.  Actual polls for BIND versions is very 
interesting -- are the incoming packets TCP?  The vendor 
said "It looks like an aborted zone transfer
normally, or a dns look-up that went wrong"; that sounds 
like TCP to me.  Also, are your machines responding?

Richard Bejtlich

--

Same here, every +/- 4 minutes they poll for our 
VERSION.BIND. I resolved
one of the ipnumbers to something.windowsupdate.com and I 
contacted the
technical contacts.