Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In the following nmap output:

$ sudo nmap -sS -sV -vv -n -Pn -T5 x.x.x.1-255 -p80,23,21 -oG - | grep 'open'

Host: x.x.x.x ()  Ports: 21/closed/tcp//ftp///, 23/open/tcp//telnet?///, 80/filtered/tcp//http///
Host: x.x.x.x ()  Ports: 21/open/tcp//ftp//D-Link or USRobotics ADSL router firmware update ftpd/, 23/open/tcp//telnet//Broadcom BCM96338 ADSL router telnetd/, 80/open/tcp//http?///
Host: x.x.x.x ()  Ports: 21/open/tcp//ftp?///, 23/open/tcp//telnet?///, 80/open/tcp//http?///
Host: x.x.x.x ()  Ports: 21/closed/tcp//ftp///, 23/open/tcp//telnet?///, 80/open/tcp//http?///
Host: x.x.x.x ()  Ports: 21/closed/tcp//ftp///, 23/closed/tcp//telnet///, 80/open/tcp//http?///

there is a question mark after the service name (ftp?, http?).

What does the question mark mean exactly?

share|improve this question
    
Why are people down-voting this? –  SteveS May 15 '13 at 18:36
add comment

3 Answers

up vote 6 down vote accepted

If Nmap isn't able to identify the service based on the signature of its response to the probing it falls back to port identification. It checks the port against a list of known port-service pairs.

So the question mark indicates that the identification was based on the port number rather than response signature.

You can find the full list in nmap-services

share|improve this answer
add comment

It basically means that nmap is not certain what service is running on that port. The more in-depth probes that the -sV flag uses does not return enough information. nmap is simply making an assumption about what service is running on that particular port based on a list of common services and their ports, for example port 80 and http.

share|improve this answer
add comment

As the others already mentioned the return values for -sV do not provide enough information to be sure about the service running on a certain port (Remember: you can run any service on any port, e.g. ftp on port 80 although this is rarely used).

To get more information you can try nmap -A which in addition to -sV also activates the nmap scripting engine. This usually provides improved information about a service.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.