I'm running apache on, which listens on port 80, 8090 and 8095 (configured as <VirtualHost *>).

Now If I open my browser and point to any of those 3 ports, e.g I will get a It works page.

Then I try to determine which port runs HTTP service with nmap,

%> nmap -p 80,8090,8095 

Starting Nmap 6.40 ( http://nmap.org ) at 2013-11-01 17:00 CST
Nmap scan report for
Host is up (0.00025s latency).
80/tcp   open  http
8090/tcp open  unknown
8095/tcp open  unknown

From the result, nmap cannot determine ports other than 80. Why is that?

Can I fix it?

  • 2
    nmap only does service detection if you pass the -sV flag. – Anorov Nov 1 '13 at 11:27

nmap defaults to the -sS option if a scan type is not specified. The -sS flag is a simple SYN scan to check the status of the port. No advanced fingerprinting is done to determine the service running on the port. In this mode, nmap merely looks up the most common service running on the particular port using the nmap-services file and displays it under the services header.

If you want more accurate fingerprinting to be done, try running nmap with the -sV or -A flag for version detection and aggressive mode respectively. The -sV version detection flag will instruct nmap to perform more intrusive scan types like making HTTP request to the port and reading the banner information for example. The -A flag goes a step further and attempts to scan the port with NSE scripts. Both the -sV and -A flag should identify Apache running on ports 8090 and 8095.

  • 1
    If -sV is not specified, nmap generate the SERVICE tab with port specifications? e.g using data from /etc/services – daisy Nov 1 '13 at 12:36
  • 1
    @warl0ck No. nmap does not use the /etc/services file for port specifications. Instead, nmap maintains a nmap-services file. In my Fedora 19 machine, the file is located at /usr/share/nmap/nmap-services. The file format is the same as the /etc/services file though, so customizing it is very possible. – user10211 Nov 1 '13 at 12:43
  • @warl0ck In addition, a custom nmap-services file can be passed as an option using the --servicedb flag. – user10211 Nov 1 '13 at 12:44
  • -A enables lots of things: service detection, OS fingerprinting, NSE script scanning, and traceroute. – bonsaiviking Nov 1 '13 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.