I am scanning two networks (of which one I know very well and the other is managed by someone else and information is sparse). The aim is to check compliance (presence of an AV listener on the machines) via an
nmap -sV -p9999 <network> (simplified version, ,the full one configures the XML output, etc.).
On the network I know the results are clean:
-sV returns consistent information, in line with what is expected (if the AV is there - a given string, if it is not there - another string or a closed port).
On the other network, though, it is very much different as most of the results point towards an open 9999 port (OK so far) but without a
The AVs (and consequently services) on all machines should be the same (thus the expected same response to a service probe).
Would you have any idea about what could block the probes (but not the SYN scans)? The port is not firewalled (the state is "open") so maybe a HIPS?
Thank you for any hints.