I am experimenting with NMAP in our network as an assignment, and I meant to do OS scan on one specific host, for which I chose the following command,

nmap -O

and I was expecting the output of this command to be FreeBSD, since I know that the host is running FreeBSD (as we have been told), but scan result shows more than 2 Operating system which is confusing,

Device type: general purpose
Running: Microsoft Windows 7|2012|XP
OS CPE: cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_server_2012 cpe:/o:microsoft:windows_xp::sp3

OS details: Microsoft Windows 7 or Windows Server 2012, Microsoft Windows XP SP3
Service Info: Host: 18; OSs: Unix, FreeBSD; CPE: cpe:/o:freebsd:freebsd

I read about OS CPE and learned that it is "Common Platform Enumeration," but shouldn't there be just one of those i.e CPE: cpe:/o:freebsd:freebsd ?

I do not understand why there are 3 CPEs, i.e, windows 7, windows 2012, and windows xp. Can they be honeypots?

3 Answers 3


It can be something in front of that host, but sometimes Nmap can give you near-matches possibilities, which I doubt that's the case in your situation.

When Nmap is unable to detect a perfect OS match, it sometimes offers up near-matches as possibilities.

If you know that host, then check which services are running on the targeted machine.

nmap -sV ...

If the result doesn't match with host that you are familiar with, then it's obvious that OS detection came from another host.


Nmap uses several techniques to attempt to predict the OS thats running on the target.

The catch is that none of the methods to do such fingerprinting are perfect, so it attempts to identify the most likely possible match.

You are seeing a mismatch with what you expect to be the OS because nmap decided that the chances of the box being a windows are higher than freebsd.

This is a great example of how tools always need a human brain to determine what is true and what is false.

  • I'm not sure this adds more than the other answer
    – schroeder
    Apr 30, 2016 at 16:36

Because of the layered nature of network protocols, Nmap can sometimes give conflicting information. What you are seeing here is two separate parts of Nmap displaying information about the target OS.

The Running, OS CPE, and OS Details output lines are produced by the OS detection engine (-O), which uses information at the transport (e.g. TCP) and network (e.g. IP) layers to fingerprint the TCP/IP stack, which is usually closely tied to the OS type and version. When the fingerprint is not unique enough to identify only one OS, multiple OS versions may be shown.

The Service Info line contains information gathered from services on the target via the service and application version detection engine (-sV). Because of NAT, port forwarding, and proxy services, this can sometimes show a different OS than -O shows. The OS info here comes from service banners as well as identified services that are only known to run on one OS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.