I'd like to know how does a vulnerability scanner such as Nessus know which services are running, once it has scanned the ports. I don't want to know the steps to do this in Nessus, I want to know what is that Nessus (or any other scanner) does.

Is it that if it finds the port 20 tcp open, it show the ftp service? This wouldn't be precise since I could be running an http service in the port 20. Any ideas or do you know somewhere I can get this information?


  • the technique you are looking for is called "banner grabbing" - Most services announce what they are when you connect to them.
    – schroeder
    Commented Mar 11, 2016 at 20:24
  • I think banner grabbing, in case of nmap, is only performed when you explicitly use nmap's banner script. Commented Mar 11, 2016 at 22:31

2 Answers 2


It really depends on the type of scan you are performing...

By default, Nmap scans report these services by making a guess based on the its nmap-services table. The nmap-services file is a registry of port names to their corresponding number and protocol. Each entry has a number representing how likely that port is to be found open. This file was originally based off the IANA assigned ports list at http://www.iana.org/assignments/port-numbers, though many other ports have been added over the years.

Version Scan

The Nmap version scanning (-sV) subsystem obtains application versions and other data by connecting to open ports and interrogating them for further information using probes that the specific services understand. More info on this service probes database can be found here. This allows Nmap to give a detailed assessment of what is really running, rather than just what port numbers are open. There is also support for community contributions -- if Nmap gets data back from a service that it does not recognize, a service fingerprint is printed along with a submission URL. The output will look something like this:

PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 4.3 (protocol 2.0) 25/tcp open smtp Postfix smtpd 80/tcp open http Apache httpd 2.2.3 ((CentOS)) 113/tcp closed auth 443/tcp open ssl/http Apache httpd 2.2.3 ((CentOS)) Service Info: Host: web.insecure.org

Banner Grabbing

It is also possible to perform banner grabbing on the services running on various ports by using Nmap's scripting engine and making use of the banner grabbing script. The output while using banner grabbing will actually include the banners supplied by the services:

21/tcp open ftp |_ banner: 220 FTP version 1.0\x0D\x0A

More details on Application and Version detection can be found here.

  • Thanks! I'll continue my research with this information.
    – deuseux12
    Commented Mar 12, 2016 at 12:42

Usually a remote scanner, such as nmap (with the necessary options), nessus or amap performs remote service enumeration. It basically tries a few probes to see if it triggers any response.

For example, if you are running HTTP on port 20/tcp, one of the triggers it will try is an HTTP HEAD/GET reqeust, if the response looks "enough" like an HTTP reponse, it will assume you're running HTTP on that port.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .