How does nmap know the application

However, high intensity scans take longer. The intensity must be between 0 and 9. The default is 7. When a probe is registered to the target port via the nmap-service-probes ports directive, that probe is tried regardless of intensity level.

This ensures that the DNS probes will always be attempted against any open port 53, the SSL probe will be done against , etc. This is a convenience alias for --version-intensity 2. This light mode makes version scanning much faster, but it is slightly less likely to identify services. An alias for --version-intensity 9 , ensuring that every single probe is attempted against each port.

This causes Nmap to print out extensive debugging info about what version scanning is doing. It is a subset of what you get with --packet-trace. Service and Version Detection Chapter Nmap Reference Guide.

Service and Version Detection. As a fallback, rndc is mentioned because that has port registered in nmap-services. Unfortunately, none of Nmap's probes elicited any sort of response from rndc. If they had, Nmap would have printed a service fingerprint and a submission URL so that it could be recognized in the next version.

As it is, Nmap requires a special probe. One might even be available by the time you read this. It is also worth noting that some services provide much more information than just the version number. Examples above include whether X11 permits connections, the SSH protocol number, and the Apache module versions list. Some of the Apache modules even had to be cut from the output to fit on this page.

This was actually just fun with stunnel , in part to ensure that parallel SSL scans actually work. Two more fields that version detection can discover are operating system and device type. These are also reported on the Service Info line. We use two techniques here. One is application exclusivity. If we identify a service as Microsoft Exchange, we know the operating system is Windows since Exchange doesn't run on anything else. The other technique is to persuade more portable applications to divulge the platform information.

Many servers especially web servers require very little coaxing. This type of OS detection is intended to complement Nmap's OS detection system -O and can sometimes report differing results. For example, consider a Microsoft Exchange server hidden behind a port-forwarding Unix firewall.

The Nmap version scanning subsystem obtains all of this data by connecting to open ports and interrogating them for further information using probes that the specific services understand. This allows Nmap to give a detailed assessment of what is really running, rather than just what port numbers are open. Example 7. Determines the application name and version number where available—not just the service protocol.

Community contributions: if Nmap gets data back from a service that it does not recognize, a service fingerprint is printed along with a submission URL. This system is patterned after the extremely successful Nmap OS Detection fingerprint submission process.