Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have Apache running on 192.168.0.201 and listening to Port 80. namp shows me that Port 80/TCP is open and service is http.

[root@desktop ~]# nmap -p 80 -sT 192.168.0.201

Starting Nmap 5.51 ( http://nmap.org ) at 2013-07-16 00:54 PDT
Nmap scan report for 192.168.0.201
Host is up (0.00083s latency).
PORT   STATE SERVICE
80/tcp open  http
MAC Address: 00:5C:53:4E:4B:00 (Dell)

Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds

I then changed Apache to listen to Port 8080 instead of Port 80. namp now shows me that Port 80/TCP is closed and service remains http. namp also now shows me that Port 8080/TCP is open and service is http-proxy.

What is the significance of http-proxy? Why did it change when I only changed the listen to port?

[root@desktop ~]# nmap -p 80 -sT 192.168.0.201

Starting Nmap 5.51 ( http://nmap.org ) at 2013-07-16 00:57 PDT
Nmap scan report for 192.168.0.201
Host is up (0.00067s latency).
PORT   STATE  SERVICE
80/tcp closed http
MAC Address: 00:5C:53:4E:4B:00 (Dell)

Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds

[root@desktop ~]# nmap -p 8080 -sT 192.168.0.201

Starting Nmap 5.51 ( http://nmap.org ) at 2013-07-16 00:57 PDT
Nmap scan report for 192.168.0.201
Host is up (0.00072s latency).
PORT     STATE SERVICE
8080/tcp open  http-proxy
MAC Address: 00:5C:53:4E:4B:00 (Dell)

Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds
[root@desktop ~]#
share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

By default, nmap does not actually check what service is running. It just searches its services file for the matching port/protocol, e.g. 80/tcp. (Most programs use /etc/services for this, while nmap has its own "extended edition".) It so happens that IANA has assigned port 80 for running regular HTTP servers, and 8080 for proxies, so that's what nmap reports.

If you want to actually check the running services, use -sV, but beware that it's much slower and very visible in the server's logs.

share|improve this answer
    
Thanks, now it makes sense. –  user1032531 Jul 16 '13 at 14:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.