guys- i've got a guy doing lookups on my nameserver with class=CHAOS and type=TXT. i think there is an exploit where if you do a lookup on "bind" or something like that it returns the version of bind you're running. i have a timestamp for when the guy is trying the query, any suggestions on how i can grab his ip addr? thanks -cjm