Re: Microsoft version.binding us now?

Hello,

Great work tracking this 3DNS signature! When I looked at
3DNS' F5 signatures last year, I found them using null 64
byte SYN packets to local name servers to try to test
latency. Actual polls for BIND versions is very
interesting -- are the incoming packets TCP? The vendor
said "It looks like an aborted zone transfer
normally, or a dns look-up that went wrong"; that sounds
like TCP to me. Also, are your machines responding?

Richard Bejtlich

--
Same here, every +/- 4 minutes they poll for our 
VERSION.BIND. I resolved
one of the ipnumbers to something.windowsupdate.com and I 
contacted the
technical contacts.