The vision of the Internet of Things (IoT) is to connect minimal embedded devices to the Internet. The constrained nature of these embedded devices makes the use of Internet Protocol impossible in its native form to establish global connectivity. To resolve this, IETF proposed 6LOWPAN, the wireless internet for embedded devices, which makes use of RPL as its routing protocol. RPL organizes low power and lossy networks in the form of one or more Destination Oriented Directed Acyclic Graphs (DODAGs). Each DODAG is assigned a version number. The purpose of the version number is to ensure that there are loop free paths to the root node, the routing table entries of nodes in the DODAG are not obsolete and there is no inconsistency in the DODAG. The root node in a DODAG increments the version number in case of any inconsistency. This calls for a global repair process and the DAG is reconstructed. A malicious node may advertise a false version number in its control message to force a global repair. In this paper, we propose an efficient framework for detecting version number attacks in the IoT. We also present mechanisms to detect the attack and identify the malicious nodes instigating the version number attack.