Nmap uses a variety of testing methods and fingerprints to determine - or at least guess at - what services are running on each discovered port, and what operating system is running on the host. (When
-O, or other appropriate options, are used.) I'm sure all of this is fairly well-documented in the Nmap online documents, and in the scripts that are run for these purposes. However, Nmap itself doesn't seem to do a very good job of exposing these internals - at least, not with default settings.
I'd like to know if there's a way to add some sort of justification for Nmap's service/OS identity selections to its output. Something that, for each service/OS ID, says something along the lines of "
[Service/OS ID] chosen because
[Test(s) used for fingerprinting] resulted in
[Response(s) received]". Even better might be an additional list of other possible fingerprint matches that are very close to the one observed, or any responses from the target system which deviated from those normally expected of the indicated service/OS.
I think some of this may be available through tweaking verbosity and debugging output levels. However, I'd rather (if natively supported) be able to get these details without bloating the output beyond what's necessary to serve this purpose.
How do I get Nmap to provide output that provides additional transparency into its service/OS fingerprinting logic? Is there a way to do this without adding a lot of other noise to the output?