2

I'm running apache on 192.168.56.178, which listens on port 80, 8090 and 8095 (configured as <VirtualHost *>).

Now If I open my browser and point to any of those 3 ports, e.g 192.168.56.178:8095 I will get a It works page.

Then I try to determine which port runs HTTP service with nmap,

%> nmap -p 80,8090,8095 192.168.56.178 

Starting Nmap 6.40 ( http://nmap.org ) at 2013-11-01 17:00 CST
Nmap scan report for 192.168.56.178
Host is up (0.00025s latency).
PORT     STATE SERVICE
80/tcp   open  http
8090/tcp open  unknown
8095/tcp open  unknown

From the result, nmap cannot determine ports other than 80. Why is that?

Can I fix it?

  • 2
    nmap only does service detection if you pass the -sV flag. – Anorov Nov 1 '13 at 11:27
6

nmap defaults to the -sS option if a scan type is not specified. The -sS flag is a simple SYN scan to check the status of the port. No advanced fingerprinting is done to determine the service running on the port. In this mode, nmap merely looks up the most common service running on the particular port using the nmap-services file and displays it under the services header.

If you want more accurate fingerprinting to be done, try running nmap with the -sV or -A flag for version detection and aggressive mode respectively. The -sV version detection flag will instruct nmap to perform more intrusive scan types like making HTTP request to the port and reading the banner information for example. The -A flag goes a step further and attempts to scan the port with NSE scripts. Both the -sV and -A flag should identify Apache running on ports 8090 and 8095.

  • 1
    If -sV is not specified, nmap generate the SERVICE tab with port specifications? e.g using data from /etc/services – daisy Nov 1 '13 at 12:36
  • 1
    @warl0ck No. nmap does not use the /etc/services file for port specifications. Instead, nmap maintains a nmap-services file. In my Fedora 19 machine, the file is located at /usr/share/nmap/nmap-services. The file format is the same as the /etc/services file though, so customizing it is very possible. – Ayrx Nov 1 '13 at 12:43
  • @warl0ck In addition, a custom nmap-services file can be passed as an option using the --servicedb flag. – Ayrx Nov 1 '13 at 12:44
  • -A enables lots of things: service detection, OS fingerprinting, NSE script scanning, and traceroute. – bonsaiviking Nov 1 '13 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.