Module: FingerprintRules
- Included in:
- DNSTraverse::Fingerprint
- Defined in:
- lib/dnstraverse/fingerprint_rules.rb
Overview
$Id: Fingerprint.pm,v 1.17 2005/09/05 13:33:36 jakob Exp $
Copyright © 2003,2004,2005 Roy Arends & Jakob Schlyter. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
-
Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
-
Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
-
The name of the authors may not be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE AUTHORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Constant Summary collapse
- QY =
[ "0,IQUERY,0,0,1,0,0,0,NOERROR,0,0,0,0", "0,NS_NOTIFY_OP,0,0,0,0,0,0,NOERROR,0,0,0,0", "0,QUERY,0,0,0,0,0,0,NOERROR,0,0,0,0", "0,IQUERY,0,0,0,0,1,1,NOERROR,0,0,0,0", "0,QUERY,0,0,0,0,0,0,NOTIMP,0,0,0,0", "0,IQUERY,1,0,1,1,1,1,NOERROR,0,0,0,0", "0,UPDATE,0,0,0,1,0,0,NOERROR,0,0,0,0", "0,QUERY,1,1,1,1,1,1,NOERROR,0,0,0,0", "0,QUERY,0,0,0,0,0,1,NOERROR,0,0,0,0", ].freeze
- INITRULE =
{ :header => QY[2], :query => ". IN MAILB" }.freeze
- IQ =
iq0
[ "1,IQUERY,0,0,1,0,0,0,FORMERR,0,0,0,0", # iq0 "1,IQUERY,0,0,1,0,0,0,FORMERR,1,0,0,0", # iq1 "1,IQUERY,0,0,1,0,0,0,NOTIMP,0,0,0,0", # iq2 "1,IQUERY,0,0,1,0,0,0,NOTIMP,1,0,0,0", # iq3 "1,IQUERY,0,0,1,1,0,0,FORMERR,0,0,0,0", # iq4 "1,IQUERY,0,0,1,1,0,0,NOTIMP,0,0,0,0", # iq5 "1,IQUERY,0,0,1,1,0,0,NOTIMP,1,0,0,0", # iq6 "1,IQUERY,1,0,1,0,0,0,NOTIMP,1,0,0,0", # iq7 "1,QUERY,1,0,1,0,0,0,NOTIMP,1,0,0,0", "1,QUERY,0,0,0,0,0,0,NOTIMP,0,0,0,0", "1,IQUERY,0,0,1,1,0,0,FORMERR,1,0,0,0", # iq10 "1,NS_NOTIFY_OP,0,0,0,0,0,0,FORMERR,1,0,0,0", "1,NS_NOTIFY_OP,0,0,0,0,0,0,NOTIMP,0,0,0,0", "1,NS_NOTIFY_OP,0,0,0,0,0,0,NOTIMP,1,0,0,0", "1,NS_NOTIFY_OP,0,0,0,0,0,0,NXDOMAIN,1,0,0,0", "1,NS_NOTIFY_OP,0,0,0,0,0,0,REFUSED,1,0,0,0", "1,NS_NOTIFY_OP,0,0,0,0,0,0,SERVFAIL,1,0,0,0", "1,NS_NOTIFY_OP,0,0,0,1,0,0,FORMERR,1,0,0,0", "1,NS_NOTIFY_OP,0,0,0,1,0,0,NOTIMP,0,0,0,0", "1,NS_NOTIFY_OP,0,0,0,1,0,0,NOTIMP,1,0,0,0", "1,NS_NOTIFY_OP,0,0,0,1,0,0,REFUSED,1,0,0,0", # iq20 "1,NS_NOTIFY_OP,0,0,0,1,0,0,SERVFAIL,1,0,0,0", "1,NS_NOTIFY_OP,1,0,0,0,0,0,NOTIMP,1,0,0,0", "1,QUERY,1,0,0,0,0,0,NOTIMP,1,0,0,0", "1,NS_NOTIFY_OP,1,0,0,0,0,0,SERVFAIL,1,0,0,0", "1,IQUERY,0,0,0,0,1,1,NOTIMP,0,0,0,0", "1,IQUERY,0,0,0,0,0,0,NOTIMP,0,0,0,0", "1,IQUERY,0,0,1,1,1,1,FORMERR,0,0,0,0", "1,IQUERY,1,0,1,1,1,1,FORMERR,0,0,0,0", "1,QUERY,.,0,1,.,.,.,NOTIMP,.+,.+,.+,.+", "1,QUERY,.,0,1,.,.,.,.+,.+,.+,.+,.+", #iq30 "1,QUERY,0,0,.,.,0,0,NXDOMAIN,1,0,0,0", "1,QUERY,0,0,.,.,0,0,FORMERR,1,0,0,0", "1,UPDATE,0,0,0,0,0,0,NOTIMP,0,0,0,0", "1,UPDATE,0,0,0,1,0,0,NOTIMP,0,0,0,0", "1,QUERY,0,0,1,0,0,0,NOERROR,1,0,0,0", "1,QUERY,1,1,1,1,1,1,NOTIMP,1,0,0,0", "1,QUERY,0,0,0,0,0,0,NOERROR,1,0,.+,0", "1,QUERY,0,0,1,0,0,0,FORMERR,1,0,0,0", "1,IQUERY,0,0,1,0,1,1,NOTIMP,1,0,0,0", "1,IQUERY,0,0,0,1,1,1,REFUSED,1,0,0,0", #iq40 "1,UPDATE,0,0,0,1,0,0,REFUSED,1,0,0,0", "1,IQUERY,0,0,0,1,1,1,FORMERR,0,0,0,0", "1,IQUERY,0,0,0,1,0,0,NOTIMP,0,0,0,0", "1,QUERY,1,0,1,0,0,0,FORMERR,1,0,0,0", "1,UPDATE,0,0,0,0,0,0,FORMERR,1,0,0,0", "1,UPDATE,0,0,0,0,0,0,FORMERR,0,0,0,0", "1,QUERY,0,0,1,0,0,0,FORMERR,0,0,0,0", "1,QUERY,0,0,1,0,0,0,SERVFAIL,1,0,0,0", #iq48 "1,QUERY,1,0,1,0,0,0,NXDOMAIN,1,0,1,0", "1,QUERY,0,0,1,0,0,0,REFUSED,1,0,0,0", #iq50 "1,QUERY,0,0,1,0,0,0,NOERROR,1,1,0,0", "1,IQUERY,0,0,1,0,0,0,REFUSED,0,0,0,0", "1,QUERY,0,0,0,0,0,0,FORMERR,0,0,0,0", "1,QUERY,0,0,1,1,1,0,NOERROR,1,0,1,0", "1,QUERY,0,0,1,1,0,0,NOERROR,1,0,1,0", "1,QUERY,0,0,1,0,1,0,NOERROR,.+,.+,.+,.+", "1,QUERY,0,0,1,0,0,0,.+,.+,.+,.+,.+", "1,QUERY,1,0,1,0,0,0,NOERROR,1,1,0,0", "1,QUERY,0,0,1,1,0,0,SERVFAIL,1,0,0,0", "1,QUERY,1,0,1,1,0,0,NOERROR,1,1,0,0", #iq60 "1,QUERY,0,0,1,1,0,0,REFUSED,1,0,0,0", "1,QUERY,0,0,0,0,0,0,NOTIMP,1,0,0,0", "1,QUERY,1,0,1,1,0,0,NOERROR,1,0,1,0", "1,IQUERY,0,0,1,1,1,1,NOTIMP,0,0,0,0", "1,UPDATE,0,0,0,0,0,0,REFUSED,0,0,0,0", "1,IQUERY,0,0,0,1,1,1,NOTIMP,1,0,0,0", "1,IQUERY,0,0,0,1,0,0,NOTIMP,1,0,0,0", "1,QUERY,0,1,1,1,1,1,NOERROR,1,0,.,0", "1,QUERY,0,1,1,1,0,1,NOERROR,1,0,.,0", "1,IQUERY,0,0,1,0,0,0,REFUSED,1,0,0,0", #iq70 "1,IQUERY,1,0,1,1,1,1,NOTIMP,1,0,0,0", "1,IQUERY,0,0,1,0,0,0,NOERROR,1,0,0,0", "1,QUERY,1,0,1,1,0,0,NOERROR,1,0,0,0", "1,IQUERY,1,0,1,1,0,0,NXDOMAIN,1,0,0,0", "1,UPDATE,0,0,0,1,0,0,FORMERR,0,0,0,0", "1,IQUERY,1,0,1,0,0,0,NXDOMAIN,1,0,0,0", "1,QUERY,0,0,1,1,0,0,FORMERR,1,0,0,0", "1,QUERY,0,0,0,1,0,0,SERVFAIL,1,0,0,0", "1,QUERY,0,0,1,1,0,0,NOERROR,1,1,0,0", "1,IQUERY,1,0,1,0,0,0,NOERROR,1,0,1,0", #iq80 "1,IQUERY,1,0,1,1,0,0,NOTIMP,1,0,0,0", "1,QUERY,0,0,1,1,0,0,NOERROR,1,0,0,0", "1,QUERY,1,0,1,1,0,0,NOERROR,1,1,1,.+", "1,QUERY,0,0,1,1,0,0,REFUSED,0,0,0,0", "1,UPDATE,0,0,0,1,0,0,NOTIMP,1,0,0,0", "1,QUERY,1,0,0,1,0,0,NXDOMAIN,1,0,0,0", "1,QUERY,0,0,0,1,0,0,NOTIMP,0,0,0,0", "1,QUERY,0,0,0,0,0,0,REFUSED,1,0,0,0", "1,QUERY,1,0,1,1,0,0,NXDOMAIN,1,0,0,0", #iq89 "1,QUERY,1,0,0,0,0,0,NOERROR,1,1,0,0", #iq90 "1,IQUERY,1,0,1,1,0,1,NOTIMP,1,0,0,0", "1,QUERY,0,0,0,1,0,0,NOTIMP,1,0,0,0", "1,QUERY,0,0,1,0,0,1,SERVFAIL,1,0,0,0", "1,QUERY,0,0,0,1,0,0,NOERROR,1,0,13,13", #iq94 "1,QUERY,0,0,0,1,0,0,NOERROR,1,0,1,0", #iq95 "1,QUERY,0,0,1,0,0,0,NOERROR,1,0,13,13", "1,IQUERY,1,0,0,0,0,0,NOTIMP,1,0,0,0", #iq97 "1,IQUERY,1,0,0,0,1,1,NOTIMP,1,0,0,0", #iq98 "1,IQUERY,0,0,1,1,0,0,NOERROR,1,0,1,0", #iq99 "1,QUERY,.,0,1,0,0,0,NOERROR,1,0,0,0", #iq100 "1,QUERY,0,0,1,0,0,0,NXDOMAIN,1,0,0,0", #101 ].freeze
- RULESET =
[ { :fingerprint => IQ[89], :result => { :vendor => "Simon Kelley", :product => "dnsmasq", :version =>""}, :qv => "version.bind", }, { :fingerprint => ".+", :header => QY[0], :query => ". IN A", :ruleset => [ { :fingerprint => "query timed out" , :header => QY[0], :query => "com. IN A", :ruleset => [ { :fingerprint => "query timed out", :header => QY[7], :query => ". CH A", :ruleset => [ { :fingerprint => "query timed out", :header => QY[6], :query => ". IN A", :ruleset => [ { :fingerprint => IQ[38], :result => { :vendor => "Digital Lumber", :product => "Oak DNS", :version =>"" }, :qv => ":version.oak",}, { :fingerprint => "query timed out", :result => "TIMEOUT",}, { :fingerprint => ".+", :state => "q0tq0tq7tq6r?", }, ] }, { :fingerprint => IQ[35], :result => { :vendor => "XBILL", :product => "jnamed (dnsjava)", :version => "" }, }, { :fingerprint => IQ[36], :result => { :vendor => "Men & Mice", :product => "QuickDNS for MacOS Classic", :version => ""}, }, { :fingerprint => IQ[37], :result => { :vendor => "unknown", :product => "NonSequitur DNS", :version => ""}, }, { :fingerprint => ".+", :state => "q0tq0tq7r?", }, ] }, { :fingerprint => IQ[35], :result => { :vendor => "eNom", :product => "eNom DNS", :version =>""}, }, { :fingerprint => ".+", :state => "q0tq0r?", },] }, { :fingerprint => IQ[0], :header => QY[1], :query=> "jjjjjjjjjjjj IN A", :ruleset => [ { :fingerprint => IQ[12], :result => { :vendor => "ISC", :product => "BIND", :version => "8.4.1-p1" }, :qv => ":version.bind",}, { :fingerprint => IQ[13], :result => { :vendor => "ISC", :product => "BIND", :version => "8 plus root server modifications"}, :qv => ":version.bind",}, { :fingerprint => IQ[15], :result => { :vendor => "Cisco", :product => "CNR", :version => ""}, }, { :fingerprint => IQ[16], :header => QY[2], :query => "hostname.bind CH TXT", :ruleset => [ { :fingerprint => IQ[58], :result => { :vendor => "ISC", :product => "BIND", :version => "8.3.0-RC1 -- 8.4.4"}, :qv => ":version.bind",}, { :fingerprint => IQ[50], :result => { :vendor => "ISC", :product => "BIND", :version => "8.3.0-RC1 -- 8.4.4"}, :qv => ":version.bind",}, { :fingerprint => IQ[48], :result => { :vendor => "ISC", :product => "BIND", :version => "8.2.2-P3 -- 8.3.0-T2A"}, :qv => ":version.bind",}, { :fingerprint => ".+", :state => "q0r0q1r16q2r?", },] }, { :fingerprint => ".+", :state => "q0r0q1r?", },] }, { :fingerprint => IQ[1], :header => QY[2], :query => ". IN IXFR", :ruleset => [ { :fingerprint => IQ[31], :result => { :vendor => "Microsoft", :product => "Windows DNS", :version => "2000" }, }, { :fingerprint => IQ[32], :result => { :vendor => "Microsoft", :product => "Windows DNS", :version => "NT4" }, }, { :fingerprint => IQ[50], :result => { :vendor => "Microsoft", :product => "Windows DNS", :version => "2003"}, }, { :fingerprint => ".+", :state => "q0r1q2r?", }, ] }, { :fingerprint => IQ[2], :header => QY[1], :ruleset => [ { :fingerprint => IQ[11], :result => { :vendor => "ISC", :product => "BIND", :version => "9.2.3rc1 -- 9.4.0a4" }, :qv => ":version.bind",}, { :fingerprint => IQ[12], :header => QY[3], :ruleset => [ { :fingerprint => IQ[25], :header => QY[6], :ruleset => [ { :fingerprint => IQ[33], :result => { :vendor => "bboy", :product => "MyDNS", :version => "" },}, { :fingerprint => IQ[34], :header => QY[2], :query => "012345678901234567890123456789012345678901234567890123456789012.012345678901234567890123456789012345678901234567890123456789012.012345678901234567890123456789012345678901234567890123456789012.0123456789012345678901234567890123456789012345678901234567890. IN A", :ruleset => [ { :fingerprint => IQ[47], :result => { :vendor => "NLnetLabs", :product => "NSD", :version => "1.0.3 -- 1.2.1"}, :qv => ":version.server", }, { :fingerprint => IQ[48], :header => QY[2], :query => "hostname.bind CH TXT", :ruleset => [ { :fingerprint => IQ[50], :result => { :vendor => "NLnetLabs", :product => "NSD", :version => "1.2.2" }, :qv => ":version.server", }, { :fingerprint => IQ[51], :header => QY[8], :query => ". IN A", :ruleset => [ { :fingerprint => IQ[93], :result => { :vendor => "NLnetLabs", :product => "NSD", :version => "1.2.3 -- 2.1.2" } , :qv => ":version.server", }, { :fingerprint => IQ[48], :result => { :vendor => "NLnetLabs", :product => "NSD", :version => "2.1.3" }, :qv => ":version.server", }, { :fingerprint => ".+", :state => "q0r2q1r12q3r25q6r34q2r48q2r51q8r?", }, ] }, { :fingerprint => ".+", :state => "q0r2q1r12q3r25q6r34q2r48q2r?", }, ] }, { :fingerprint => IQ[49], :header => QY[2], :query => "hostname.bind CH TXT", :ruleset => [ { :fingerprint => IQ[50], :result => { :vendor => "NLnetLabs", :product => "NSD", :version => "1.2.2 [root]"} , :qv => ":version.server", }, { :fingerprint => IQ[51], :result => { :vendor => "NLnetLabs", :product => "NSD", :version => "1.2.3 [root]"}, :qv => ":version.server", }, { :fingerprint => ".+", :state => "q0r2q1r12q3r25q6r34q2r49q2r?", }, ] }, { :fingerprint => IQ[53], :result => { :vendor => "NLnetLabs", :product=>"NSD", :version => "1.0.2"}, :qv => ":version.server", }, { :fingerprint => ".+", :state => "q0r2q1r12q3r25q6r34q2a?", },] }, { :fingerprint => ".+", :state => "q0r2q1r12q3r25q6r?", },] }, { :fingerprint => IQ[26], :result => { :vendor => "VeriSign", :product => "ATLAS", :version => ""},}, { :fingerprint => ".+", :state => "q0r2q1r12q3r?", },] }, { :fingerprint => IQ[15], :header => QY[6], :ruleset => [ { :fingerprint => IQ[45], :result => { :vendor => "Nominum", :product =>"ANS", :version =>""}, :qv => ":version.bind",}, { :fingerprint => IQ[65], :result => { :vendor => "ISC", :product => "BIND", :version => "9.2.3rc1 -- 9.4.0a4" }, :qv => ":version.bind",}, { :fingerprint => IQ[46], :header => QY[7], :ruleset => [ { :fingerprint => IQ[56], :result => { :vendor => "ISC", :product => "BIND", :version => "9.0.0b5 -- 9.0.1" }, :qv => ":version.bind",}, { :fingerprint => IQ[57], :result => { :vendor => "ISC", :product => "BIND", :version => "9.1.0 -- 9.1.3" }, :qv => ":version.bind",}, { :fingerprint => ".+", :state => "q0r2q1r15q6r46q7r?", }, ] }, { :fingerprint => ".+", :state => "q0r2q1r15q6r?", },] }, { :fingerprint => IQ[16], :header => QY[4], :ruleset => [ { :fingerprint => IQ[29], :result => { :vendor => "ISC", :product => "BIND", :version => "9.2.0a1 -- 9.2.0rc3"}, :qv => ":version.bind",}, { :fingerprint => IQ[30], :header => QY[0], :query => ". A CLASS0" , :ruleset => [ { :fingerprint => IQ[2], :result => { :vendor=>"ISC", :product => "BIND", :version =>"9.2.0rc7 -- 9.2.2-P3"}, :qv => ":version.bind", }, { :fingerprint => IQ[0], :result => { :vendor=>"ISC", :product => "BIND", :version =>"9.2.0rc4 -- 9.2.0rc6"}, :qv => ":version.bind", }, { :fingerprint => ".+", :result => { :vendor => "ISC", :product => "BIND", :version =>"9.2.0rc4 -- 9.2.2-P3"}, :qv => ":version.bind", }, ] }, { :fingerprint => ".+", :state => "q0r2q1r16q4r?", },] }, { :fingerprint => ".+", :state => "q0r2q1r?", }, ] }, { :fingerprint => IQ[3], :header => QY[1], :ruleset => [ { :fingerprint => "query timed out", :header => QY[5], :ruleset => [ { :fingerprint => IQ[3], :result => { :vendor => "sourceforge", :product =>"Dents", :version =>""}, :qv => ":version.bind", }, { :fingerprint => IQ[81], :result => { :vendor => "Microsoft", :product => "Windows DNS", :version => "2003" },}, { :fingerprint => IQ[91], :result => { :vendor => "Microsoft", :product => "Windows DNS", :version => "2003" },}, { :fingerprint => ".+", :state => "q0r3q1tq5r?", }, ] }, { :fingerprint => IQ[14], :result => { :vendor => "UltraDNS", :product => "", :version =>"v2.7.0.2 -- 2.7.3"}, :qv => ":version.bind", }, { :fingerprint => IQ[13], :header => QY[5], :ruleset => [ { :fingerprint => IQ[39], :result => { :vendor => "pliant", :product => "DNS Server", :version =>""},}, { :fingerprint => IQ[7], :result => { :vendor => "JHSOFT", :product => "simple DNS plus", :version =>""}, }, { :fingerprint => IQ[71], :header => QY[6], :ruleset => [ { :fingerprint => IQ[41], :result => { :vendor =>"Netnumber", :product =>"ENUM server", :version =>""}, }, { :fingerprint => IQ[85], :result => { :vendor =>"Raiden", :product => "DNSD", :version => ""}, }, ] }, { :fingerprint => ".+", :state => "q0r3q1r13q5r?", }, ] }, { :fingerprint => ".+", :state => "q0r3q1r?", }, ] }, { :fingerprint => IQ[4], :header => QY[1], :query=> "jjjjjjjjjjjj IN A", :ruleset => [ { :fingerprint => IQ[17], :result => { :vendor => "ISC", :product => "BIND", :version =>"9.0.0b5 -- 9.0.1 [recursion enabled]"}, :qv => ":version.bind", }, { :fingerprint => IQ[18], :header => QY[5], :query=> ". IN A" , :ruleset => [ { :fingerprint => IQ[27], :result => { :vendor => "ISC", :product => "BIND", :version => "4.9.3 -- 4.9.11"}, :qv => ":version.bind", }, { :fingerprint => IQ[28], :result => { :vendor => "ISC", :product => "BIND", :version => "4.8 -- 4.8.3"}, }, { :fingerprint => ".+", :state => "q0r4q1r18q5r?", }, ] }, { :fingerprint => IQ[19], :result => {:vendor => "ISC", :product =>"BIND", :version => "8.2.1 [recursion enabled]"}, :qv => ":version.bind", }, { :fingerprint => IQ[20], :header => QY[3], :query=> ". IN A", :ruleset => [ { :fingerprint => IQ[42], :result => {:vendor => "ISC", :product =>"BIND", :version =>"8.1-REL -- 8.2.1-T4B [recursion enabled]"}, :qv => ":version.bind", }, { :fingerprint => ".+", :state => "q0r4q1r20q3r?", },] }, { :fingerprint => IQ[21], :header => QY[2], :query => "hostname.bind CH TXT", :ruleset => [ { :fingerprint => IQ[60], :result => {:vendor =>"ISC", :product => "BIND", :version => "8.3.0-RC1 -- 8.4.4 [recursion enabled]"}, :qv => ":version.bind",}, { :fingerprint => IQ[59], :header => QY[7], :query=> ". IN A", :ruleset => [ { :fingerprint => IQ[68], :result => {:vendor =>"ISC", :product => "BIND", :version => "8.1-REL -- 8.2.1-T4B [recursion enabled]"}, :qv => ":version.bind", }, { :fingerprint => IQ[69], :result => {:vendor =>"ISC", :product => "BIND", :version => "8.2.2-P3 -- 8.3.0-T2A [recursion enabled]"}, :qv => ":version.bind",}, { :fingerprint => "connection failed", :result => { :vendor =>"Runtop", :product => "dsl/cable", :version =>""},}, { :fingerprint => ".+", :state => "q0r4q1r21q2r59q7r?", },] }, { :fingerprint => IQ[58], :result => {:vendor => "ISC", :product =>"BIND", :version => "8.3.0-RC1 -- 8.4.4 [recursion local]"}, :qv => ":version.bind",}, { :fingerprint => IQ[50], :result => {:vendor => "ISC", :product =>"BIND", :version => "8.3.0-RC1 -- 8.4.4 [recursion local]"}, :qv => ":version.bind",}, { :fingerprint => IQ[61], :result => {:vendor => "ISC", :product =>"BIND", :version => "8.3.0-RC1 -- 8.4.4 [recursion local]"}, :qv => ":version.bind",}, { :fingerprint => IQ[48], :result => {:vendor => "ISC", :product =>"BIND", :version => "8.2.2-P3 -- 8.3.0-T2A [recursion local]"}, :qv => ":version.bind",}, { :fingerprint => ".+", :state => "q0r4q1r21q2r?", },] }, { :fingerprint => ".+", :state => "q0r4q1r?", }, ] }, { :fingerprint => IQ[5], :header => QY[1], :ruleset => [ { :fingerprint => IQ[11], :result => { :vendor => "ISC", :product => "BIND", :version => "9.2.3rc1 -- 9.4.0a4", :option => "recursion enabled,split view" }, :qv => ":version.bind",}, { :fingerprint => IQ[17], :result => {:vendor => "ISC", :product =>"BIND", :version => "9.2.3rc1 -- 9.4.0a4 [recursion enabled]"}, :qv => ":version.bind",}, { :fingerprint => IQ[18], :header => QY[5], :ruleset => [ { :fingerprint => IQ[5], :header => QY[7], :query => ". IN A", :ruleset => [ { :fingerprint => IQ[84], :result => {:vendor => "Nominum", :product =>"CNS", :version => ""}, :qv => ":version.bind",}, { :fingerprint => IQ[59], :result => {:vendor => "Mikrotik", :product =>"dsl/cable", :version => ""}, }, { :fingerprint => IQ[82], :result => {:vendor => "Mikrotik", :product =>"dsl/cable", :version => ""}, }, { :fingerprint => ".+", :state => "q0r5q1r18q5r5q7r?", }, ] }, ## { :fingerprint => IQ[64], :result => "unknown, smells like old BIND 4", }, { :fingerprint => ".+", :state => "q0r5q1r18q5r?", }, ] }, { :fingerprint => IQ[20], :header => QY[7], :ruleset => [ { :fingerprint => IQ[54], :result => {:vendor => "ISC", :product =>"BIND", :version => "9.0.0b5 -- 9.0.1 [recursion enabled]"}, :qv => ":version.bind",}, { :fingerprint => IQ[55], :result => {:vendor => "ISC", :product =>"BIND", :version => "9.1.0 -- 9.1.3 [recursion enabled]"}, :qv => ":version.bind",}, { :fingerprint => IQ[63], :result => {:vendor => "ISC", :product =>"BIND", :version => "4.9.3 -- 4.9.11 [recursion enabled]"}, :qv => ":version.bind",}, { :fingerprint => IQ[61], :result => {:vendor => "ISC", :product =>"BIND", :version => "9.0.0b5 -- 9.1.3 [recursion local]"}, :qv => ":version.bind",}, { :fingerprint => ".+", :state => "q0r5q1r20q7r?", }, ] }, { :fingerprint => IQ[21], :header => QY[4], :ruleset => [ { :fingerprint => "query timed out", :result => {:vendor => "ISC", :product =>"BIND", :version => "9.2.0a1 -- 9.2.2-P3 [recursion enabled]"}, :qv => ":version.bind", }, { :fingerprint => IQ[29], :result => {:vendor => "ISC", :product =>"BIND", :version => "9.2.0a1 -- 9.2.0rc3 [recursion enabled]"}, :qv => ":version.bind", }, { :fingerprint => IQ[61], :header => QY[0], :query => ". A CLASS0" , :ruleset => [ { :fingerprint => IQ[2], :result => {:vendor => "ISC", :product =>"BIND", :version => "9.2.0rc7 -- 9.2.2-P3 [recursion local]"}, :qv => ":version.bind", }, { :fingerprint => IQ[0], :result => {:vendor => "ISC", :product =>"BIND", :version => "9.2.0a1 -- 9.2.0rc6 [recursion local]"}, :qv => ":version.bind", }, { :fingerprint => ".+", :result => {:vendor => "ISC", :product =>"BIND", :version => "9.2.0a1 -- 9.2.2-P3 [recursion local]"}, :qv => ":version.bind", }, ] }, { :fingerprint => IQ[30], :header => QY[0], :query => ". A CLASS0" , :ruleset => [ { :fingerprint => IQ[2], :result => {:vendor => "ISC", :product =>"BIND", :version => "9.2.0rc7 -- 9.2.2-P3 [recursion enabled]"}, :qv => ":version.bind", }, { :fingerprint => IQ[0], :result => {:vendor => "ISC", :product =>"BIND", :version => "9.2.0rc4 -- 9.2.0rc6 [recursion enabled]"}, :qv => ":version.bind", }, { :fingerprint => ".+", :result => {:vendor => "ISC", :product =>"BIND", :version => "9.2.0rc4 -- 9.2.2-P3 [recursion enabled]"}, :qv => ":version.bind", }, ] }, { :fingerprint => ".+", :state => "q0r5q1r21q4r?", }, ] }, { :fingerprint => ".+", :state => "q0r5q1r?", }, ] }, { :fingerprint => IQ[6], :header => QY[1], :ruleset => [ { :fingerprint => IQ[15], :result => {:vendor => "incognito", :product =>"DNS commander", :version => "v2.3.1.1 -- 4.0.5.1"}, :qv => ":version.bind", }, { :fingerprint => IQ[19], :header => QY[3], :ruleset => [ { :fingerprint => IQ[66], :result => {:vendor => "vermicelli", :product =>"totd", :version => ""}, }, { :fingerprint => IQ[67], :result => {:vendor => "JHSOFT", :product =>"simple DNS plus", :version => "[recursion enabled]"}, }, { :fingerprint => ".+", :state => "q0r6q1r19q3r?", }, ] }, { :fingerprint => ".+", :state => "q0r6q1r?", }, ] }, { :fingerprint => IQ[7], :header => QY[1], :ruleset => [ { :fingerprint => IQ[22], :header => QY[3], :ruleset => [ { :fingerprint => IQ[97], :result => {:vendor => "PowerDNS", :product =>"PowerDNS", :version => "2.9.4 -- 2.9.19"}, :qv => "version.bind", }, { :fingerprint => IQ[98], :result => {:vendor => "Stanford", :product =>"lbnamed", :version => "1.0.0 -- 2.3.2"}, }, { :fingerprint => ".+", :state => "q0r7q1r22q3r?", }, ] }, { :fingerprint => IQ[24], :result => {:vendor => "PowerDNS", :product =>"PowerDNS", :version => "2.8 -- 2.9.3"}, :qv => ":version.bind", }, { :fingerprint => ".+", :state => "q0r7q1r?", }, ] }, { :fingerprint => IQ[8], :header => QY[1], :ruleset => [ { :fingerprint => IQ[23], :header => QY[2] , :query => ". CH A", :ruleset => [ { :fingerprint => "query timed out", :result => { :vendor => "DJ Bernstein", :product => "TinyDNS", :version => "1.04"} ,}, { :fingerprint => IQ[32], :result => {:vendor => "DJ Bernstein", :product => "TinyDNS", :version => "1.05"} ,}, { :fingerprint => ".+", :state => "q0r8q1r23q2r?",},] }, { :fingerprint => ".+", :state => "q0r8q1r?", }, ] }, { :fingerprint => IQ[9], :header => QY[1], :ruleset => [ { :fingerprint => IQ[9], :result => { :vendor => "Sam Trenholme", :product =>"MaraDNS", :version => ""}, :qv => "erre-con-erre-cigarro.maradns.org"}, { :fingerprint => ".+", :state => "q0r9q1r?", }, ] }, { :fingerprint => IQ[10], :result => { :vendor => "Microsoft", :product =>"?", :version => ""}, }, { :fingerprint => IQ[26], :result => { :vendor => "Meilof Veeningen", :product =>"Posadis", :version =>""}, }, { :fingerprint => IQ[43], :header => QY[6], :ruleset => [ { :fingerprint => IQ[34], :result => { :vendor => "Paul Rombouts", :product =>"pdnsd", :version =>""}, }, { :fingerprint => IQ[75], :result => { :vendor => "antirez", :product =>"Yaku-NS", :version =>""}, }, { :fingerprint => ".+", :state => "q0r43q6r?", }, ] }, { :fingerprint => IQ[44], :result => { :vendor =>"cpan", :product=>"Net::DNS Nameserver", :version =>""}, :qv => ":version.bind", }, { :fingerprint => IQ[52], :result => { :vendor =>"NLnetLabs", :product=>"NSD", :version => "1.0 alpha"}, }, { :fingerprint => IQ[55], :header => QY[3], :ruleset => [ { :fingerprint => IQ[94], :result => { :vendor =>"robtex", :product=>"Viking DNS module", :version=>""}, }, { :fingerprint => IQ[95], :result => { :vendor =>"cisco", :product=>"dns resolver/server", :version=>""}, }, { :fingerprint => ".+", :state => "q0r55q3r?", }, ] }, { :fingerprint => IQ[59], :result => { :vendor =>"Max Feoktistov", :product=>"small HTTP server [recursion enabled]", :version =>""}, }, { :fingerprint => IQ[60], :result => { :vendor =>"Axis", :product=>"video server", :version =>""}, }, { :fingerprint => IQ[62], :header => QY[7], :query => "1.0.0.127.in-addr.arpa. IN PTR", :ruleset => [ { :fingerprint => IQ[62], :result => { :vendor =>"Michael Tokarev", :product=>"rbldnsd",:version=>""}, :qv => ":version.bind", }, { :fingerprint => IQ[79], :result => { :vendor =>"4D", :product=>"WebSTAR", :version=>""}, }, { :fingerprint => IQ[83], :result => { :vendor =>"Netopia", :product =>"dsl/cable", :version => ""},}, { :fingerprint => IQ[90], :result => { :vendor =>"TZO", :product=>"Tzolkin DNS",:version=>""}, }, { :fingerprint => "query timed out", :result => { :vendor =>"Netopia", :product =>"dsl/cable", :version=>""},}, { :fingerprint => ".+", :state => "q0r62q7r?", }, ] }, { :fingerprint => IQ[70], :result => { :vendor =>"Yutaka Sato", :product=>"DeleGate DNS", :version=>""},}, { :fingerprint => IQ[72], :result => { :vendor =>"", :product =>"sheerdns", :version=>""}, }, { :fingerprint => IQ[73], :result => { :vendor =>"Matthew Pratt", :product=>"dproxy", :version=>""}, }, { :fingerprint => IQ[74], :result => { :vendor =>"Brad Garcia", :product=>"dnrd",:version=>""}, }, { :fingerprint => IQ[76], :result => { :vendor =>"Sourceforge", :product=>"JDNSS",:version=>""}, }, { :fingerprint => IQ[77], :result => { :vendor =>"Dan Kaminsky", :product=>"nomde DNS tunnel",:version=>""}, }, { :fingerprint => IQ[78], :result => { :vendor =>"Max Feoktistov", :product=>"small HTTP server", :version =>""}, }, { :fingerprint => IQ[79], :result => { :vendor =>"robtex", :product=>"Viking DNS module", :version=>""}, }, { :fingerprint => IQ[80], :result => { :vendor =>"Fasthosts", :product=>"Envisage DNS server", :version=>""}, }, { :fingerprint => IQ[81], :result => { :vendor =>"WinGate", :product=>"Wingate DNS", :version=>""},}, { :fingerprint => IQ[82], :result => { :vendor =>"Ascenvision", :product=>"SwiftDNS", :version=>""},}, { :fingerprint => IQ[86], :result => { :vendor =>"Nortel Networks", :product=>"Instant Internet",:version=>""}, }, { :fingerprint => IQ[87], :result => { :vendor =>"ATOS", :product=>"Stargate ADSL", :version=>""},}, { :fingerprint => IQ[88], :result => { :vendor =>"3Com", :product=>"Office Connect Remote", :version=>""},}, { :fingerprint => IQ[89], :result => { :vendor =>"Alteon", :product=>"ACEswitch", :version=>""},}, { :fingerprint => IQ[90], :result => { :vendor =>"javaprofessionals", :product=>"javadns/jdns", :version=>""},}, { :fingerprint => IQ[92], :result => { :vendor =>"Beehive", :product=>"CoDoNS",:version=>""}, }, { :fingerprint => IQ[96], :result => { :vendor =>"Beevihe", :product=>"AAAAAA",:version=>""}, :qv => "version.bind", }, { :fingerprint => IQ[100], :result => { :vendor =>"ValidStream", :product=>"ValidDNS",:version=>""}, }, { :fingerprint => IQ[101], :result => { :vendor =>"ValidStream", :product=>"ValidDNS",:version=>""}, }, { :fingerprint => ".+", :state => "q0r?", }, ] } ].freeze