Service running on a closed port?

Question

I just finished scanning a host and I found something unusual. My question is regarding port 50000 and 50002. Nmap shows that these ports are closed and also identifies the services running on them!How is that possible? Doesn't a closed port mean that there isn't anything running on it?

papagolf@Sierra:~$ nmap -v www.****.com
Host is up (0.28s latency).
rDNS record for 50.***.***.***: -----
Not shown: 987 filtered ports
PORT      STATE  SERVICE
21/tcp    open   ftp
22/tcp    open   ssh
80/tcp    open   http
443/tcp   open   https
50000/tcp closed ibm-db2
50001/tcp closed unknown
50002/tcp closed iiimsf
50003/tcp closed unknown
50300/tcp closed unknown
50389/tcp closed unknown
50500/tcp closed unknown
50636/tcp closed unknown
50800/tcp closed unknown

Answer 1

From nmap documentation here: https://nmap.org/book/man-port-scanning-basics.html

A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it.

This means that the host has responded (most likely with an RST) to the SYN packet sent by Nmap. I didn't see any explicit reference to this in the standard (RFC 793), but this is the most reasonable explanation that comes to my mind. It would be normal for Nmap to interpret this as a closed port - yet, use it to sort of "make a note" that hey there is a host on this IP address; and even try to use possible variations in responses to fingerprint the OS.

Yes, as already mentioned by @schroeder, the label to the port is simply from an internal reference table - not by any real fingerprinting.

Answer 2

A closed port means that nmap has received either a RST (for tcp) or a icmp type 3 code 3 (for udp). each port is assigned a well known service, mostly based on iana. see https://nmap.org/book/nmap-services.html.