[lug] CHAOS

charles at lunarmedia.net charles at lunarmedia.net
Tue Feb 27 15:31:31 MST 2001

i've got a guy doing lookups on my nameserver with class=CHAOS and
type=TXT. i think there is an exploit where if you do a lookup on "bind"
or something like that it returns the version of bind you're running.

i have a timestamp for when the guy is trying the query, any suggestions
on how i can grab his ip addr?

thanks -cjm

More information about the LUG mailing list