/usr/share/perl5/Net/DNS/REPLACE is in libnet-dns-fingerprint-perl 20130404-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 | After you generate a perl tree from the generator, go through it and replace the
non-responses with the right error.
-------------------------------------------------------------------------------
"0,QUERY,0,0,1,0,0,0,NOERROR,1,0,0,0" => "header section incomplete" #Unbound
"0.+" => "query timed out" #Windows Server(s)
-------------------------------------------------------------------------------
e.g
If you have the responses
"0,NS_NOTIFY_OP,0,1,1,0,1,1,NOTIMP,1,0,0,0", #iq7
"1,IQUERY,0,0,0,1,0,0,NOTIMP,1,0,0,0", #iq8
"0,IQUERY,0,0,0,1,1,1,NOERROR,1,0,0,0", #iq9
"1,QUERY,0,0,1,0,0,0,NOTIMP,1,0,0,0", #iq10
"0,QUERY,0,0,1,0,0,0,NOERROR,1,0,0,0", #iq11
part of the tree
{ fingerprint => $iq[8], result => { vendor =>"Microsoft", product=>"Windows DNS", version=>"2003"}, },
{ fingerprint=>$iq[9], header=>$qy[4], query=>$nct[4], ruleset => [
{ fingerprint => $iq[10], result => { vendor =>"Microsoft", product=>"Windows DNS", version=>"2003 R2"}, },
{ fingerprint=>$iq[11], header=>$qy[5], query=>$nct[5], ruleset => [
{ fingerprint => $iq[11], result => { vendor =>"Microsoft", product=>"Windows DNS", version=>"2008 R2"}, },
{ fingerprint => $iq[10], result => { vendor =>"Microsoft", product=>"Windows DNS", version=>"2008"}, },
{ fingerprint => ".+", state=>"q0r3q1r3q2r7q3r9q4r11q5r?" },
should become
{ fingerprint => $iq[8], result => { vendor =>"Microsoft", product=>"Windows DNS", version=>"2003"}, },
{ fingerprint=>"query timed out", header=>$qy[4], query=>$nct[4], ruleset => [
{ fingerprint => $iq[10], result => { vendor =>"Microsoft", product=>"Windows DNS", version=>"2003 R2"}, },
{ fingerprint=>"query timed out", header=>$qy[5], query=>$nct[5], ruleset => [
{ fingerprint => "query timed out", result => { vendor =>"Microsoft", product=>"Windows DNS", version=>"2008 R2"}, },
{ fingerprint => $iq[10], result => { vendor =>"Microsoft", product=>"Windows DNS", version=>"2008"}, },
{ fingerprint => ".+", state=>"q0r3q1r3q2r7q3r9q4r11q5r?" },
if you follow the replace instructions
There is an unresolved bug where BIND 9.4.0 -- 9.5.1 identifies as BIND 9.6.0, this is
temporarily fixed by replacing
{ fingerprint => $iq[21], result => { vendor =>"ISC", product=>"BIND", version=>"9.6.0"}, },
with
{ fingerprint => $iq[21], result => { vendor =>"ISC", product=>"BIND", version=>"9.6.0 OR 9.4.0 -- 9.5.1"}, },
|