I need to get details of the software being used. I have the IP addresses.
You could try querying the respective resource records in the CH class, see Built-in server information zones. This will most likely fail.
Then you could try the things described in RFC 4892. If these fail, too, you could try to identify the name server by analyzing its behavior, e. g. source port distribution when doing a lot of queries.
And last but not least, you could just ask the administrator of the name server which software he's using. Actually this would be the first thing I'd try.