Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am scanning two networks (of which one I know very well and the other is managed by someone else and information is sparse). The aim is to check compliance (presence of an AV listener on the machines) via an nmap -sV -p9999 <network> (simplified version, ,the full one configures the XML output, etc.).

On the network I know the results are clean: -sV returns consistent information, in line with what is expected (if the AV is there - a given string, if it is not there - another string or a closed port).

On the other network, though, it is very much different as most of the results point towards an open 9999 port (OK so far) but without a <service> information.

The AVs (and consequently services) on all machines should be the same (thus the expected same response to a service probe).

Would you have any idea about what could block the probes (but not the SYN scans)? The port is not firewalled (the state is "open") so maybe a HIPS?

Thank you for any hints.

share|improve this question

The -sV option send a couple of probes to determine what service, and what version is running. Receiving an 'open' state without service means :

  • No know fingerprint has been returned.
  • nmap did not have the time to make those probes.

I would suggest to use -vv to generate verbose output, or --version-trace.

If you are using agressive timing, try without any performance setting (no -T4, no -A, no --host-timeout, etc...) otherwise nmap might just skip 'version detection'.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .