NMAP DNS Service Detection

Question

I was looking out how NMAP identifies DNS services. After determining that port 53 is open it issues a standard query TXT version.bind to find out if BIND is running on the domain port. Then, I saw that after NMAP received the response:

    9.3.6-P1-RedHat-9.3.6-16.P1.el5_7.1

it issued a "Server Status Request" and received a "Server Status Request Response, Not implemented" and displayed port 53 as open but did not specify a version. What is a "Server Status Request" and why did NMAP not lable the port as running BIND considering that it received the version?

Answer 1

Is the DNS service you are probing over TCP or UDP? There is a match line that looks appropriate (line 8836 in the latest SVN version), but it is only matched for TCP ports. Also, the fingerprint was added on February 4, 2012, so if you are using a version earlier than 5.61TEST5, you will not detect this service properly.

Nmap's service detection database is built from user submissions. If you have a service that is not being detected correctly, make sure your Nmap is up-to-date and re-run the version scan with these arguments:

nmap -v -sV --version-all -p 53 example.com

and follow the instructions for submitting the fingerprint.

Answer 2

Server Status Requests (OPCODE 2) are a very optional part of the DNS protocol, which BIND hasn't implemented, so that response is normal.

Looking in nmap-service-probes on my own machine it doesn't look like nmap knows that "9.3.6-P1-RedHat-9.3.6-16.P1.el5_7.1" is a version of BIND. (It seems to expect BIND instances to use the word BIND in their reply.)