Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am scanning two networks (of which one I know very well and the other is managed by someone else and information is sparse). The aim is to check compliance (presence of an AV listener on the machines) via an nmap -sV -p9999 <network> (simplified version, ,the full one configures the XML output, etc.).

On the network I know the results are clean: -sV returns consistent information, in line with what is expected (if the AV is there - a given string, if it is not there - another string or a closed port).

On the other network, though, it is very much different as most of the results point towards an open 9999 port (OK so far) but without a <service> information.

The AVs (and consequently services) on all machines should be the same (thus the expected same response to a service probe).

Would you have any idea about what could block the probes (but not the SYN scans)? The port is not firewalled (the state is "open") so maybe a HIPS?

Thank you for any hints.

share|improve this question
add comment

1 Answer

The -sV option send a couple of probes to determine what service, and what version is running. Receiving an 'open' state without service means :

  • No know fingerprint has been returned.
  • nmap did not have the time to make those probes.

I would suggest to use -vv to generate verbose output, or --version-trace.

If you are using agressive timing, try without any performance setting (no -T4, no -A, no --host-timeout, etc...) otherwise nmap might just skip 'version detection'.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.