Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am scanning two networks (of which one I know very well and the other is managed by someone else and information is sparse). The aim is to check compliance (presence of an AV listener on the machines) via an nmap -sV -p9999 <network> (simplified version, ,the full one configures the XML output, etc.).

On the network I know the results are clean: -sV returns consistent information, in line with what is expected (if the AV is there - a given string, if it is not there - another string or a closed port).

On the other network, though, it is very much different as most of the results point towards an open 9999 port (OK so far) but without a <service> information.

The AVs (and consequently services) on all machines should be the same (thus the expected same response to a service probe).

Would you have any idea about what could block the probes (but not the SYN scans)? The port is not firewalled (the state is "open") so maybe a HIPS?

Thank you for any hints.

share|improve this question
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.