I'm running apache on, which listens on port 80, 8090 and 8095 (configured as <VirtualHost *>).

Now If I open my browser and point to any of those 3 ports, e.g I will get a It works page.

Then I try to determine which port runs HTTP service with nmap,

%> nmap -p 80,8090,8095 

Starting Nmap 6.40 ( http://nmap.org ) at 2013-11-01 17:00 CST
Nmap scan report for
Host is up (0.00025s latency).
80/tcp   open  http
8090/tcp open  unknown
8095/tcp open  unknown

From the result, nmap cannot determine ports other than 80. Why is that?

Can I fix it?

  • 2
    nmap only does service detection if you pass the -sV flag.
    – Anorov
    Nov 1, 2013 at 11:27

1 Answer 1


nmap defaults to the -sS option if a scan type is not specified. The -sS flag is a simple SYN scan to check the status of the port. No advanced fingerprinting is done to determine the service running on the port. In this mode, nmap merely looks up the most common service running on the particular port using the nmap-services file and displays it under the services header.

If you want more accurate fingerprinting to be done, try running nmap with the -sV or -A flag for version detection and aggressive mode respectively. The -sV version detection flag will instruct nmap to perform more intrusive scan types like making HTTP request to the port and reading the banner information for example. The -A flag goes a step further and attempts to scan the port with NSE scripts. Both the -sV and -A flag should identify Apache running on ports 8090 and 8095.

  • 1
    If -sV is not specified, nmap generate the SERVICE tab with port specifications? e.g using data from /etc/services
    – daisy
    Nov 1, 2013 at 12:36
  • 1
    @warl0ck No. nmap does not use the /etc/services file for port specifications. Instead, nmap maintains a nmap-services file. In my Fedora 19 machine, the file is located at /usr/share/nmap/nmap-services. The file format is the same as the /etc/services file though, so customizing it is very possible.
    – user10211
    Nov 1, 2013 at 12:43
  • @warl0ck In addition, a custom nmap-services file can be passed as an option using the --servicedb flag.
    – user10211
    Nov 1, 2013 at 12:44
  • -A enables lots of things: service detection, OS fingerprinting, NSE script scanning, and traceroute. Nov 1, 2013 at 14:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .