Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was looking out how NMAP identifies DNS services. After determining that port 53 is open it issues a standard query TXT version.bind to find out if BIND is running on the domain port. Then, I saw that after NMAP received the response:

    9.3.6-P1-RedHat-9.3.6-16.P1.el5_7.1

it issued a "Server Status Request" and received a "Server Status Request Response, Not implemented" and displayed port 53 as open but did not specify a version. What is a "Server Status Request" and why did NMAP not lable the port as running BIND considering that it received the version?

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

Is the DNS service you are probing over TCP or UDP? There is a match line that looks appropriate (line 8836 in the latest SVN version), but it is only matched for TCP ports. Also, the fingerprint was added on February 4, 2012, so if you are using a version earlier than 5.61TEST5, you will not detect this service properly.

Nmap's service detection database is built from user submissions. If you have a service that is not being detected correctly, make sure your Nmap is up-to-date and re-run the version scan with these arguments:

nmap -v -sV --version-all -p 53 example.com

and follow the instructions for submitting the fingerprint.

share|improve this answer
1  
Sounds like I should upgrade my copy of nmap, then. :-) –  Graham Hill Apr 19 '12 at 14:01
    
That was the issue. Thanks. –  Bhubhu Hbuhdbus Apr 19 '12 at 16:20
add comment

Server Status Requests (OPCODE 2) are a very optional part of the DNS protocol, which BIND hasn't implemented, so that response is normal.

Looking in nmap-service-probes on my own machine it doesn't look like nmap knows that "9.3.6-P1-RedHat-9.3.6-16.P1.el5_7.1" is a version of BIND. (It seems to expect BIND instances to use the word BIND in their reply.)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.