Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to catalog which smtp servers are used in an heterogenous pool of servers, and so far I was doing :

echo "HELO localhost"  | telnet localhost 25 2>/dev/null | grep 220
#process the output of command

My problem is the server doesn't always have time to answer "220 ..." before the socket is closed.

So I'm looking of a relatively short, bash-based script that would be a bit more reliable. I couldn't find an easy way to make the command wait a few seconds before closing the TCP connection.

I tried expect but i can't get it to work, and that requires an external file, which doesn't really fit in my auditing suite, and I can't be sure to have it available on all servers.

Any simple ideas ?

EDIT : versions (yep, old, I know):

  • bash-2.05b-41.7
  • coreutils-4.5.3-28.1
  • linux-2.4.21
share|improve this question
Just ping for a few packets, works great as an easy pause. :) – Ƭᴇcʜιᴇ007 Sep 17 '13 at 17:29
I don't get it. – mveroone Sep 18 '13 at 7:20

Use nmap(1) fingerprinting capabilities, from the manpage:

-sV: Probe open ports to determine service/version info

An example:

$ nmap -sV -p 25

Starting Nmap 6.40 ( ) at 2013-09-17 17:50 CEST
    Nmap scan report for (
Host is up (0.0052s latency).
25/tcp open  smtp    MailEnable smptd 7.08--7.08
Service Info: Host:; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at .
Nmap done: 1 IP address (1 host up) scanned in 13.67 seconds

I don't know if it is useful for you, but the output uses CPE.

share|improve this answer
Unfortunatly, nmap isn't available on most machines, and I can't install more softwares for this "project" needs'. – mveroone Sep 17 '13 at 16:04
You are not supposed to install it on every machine, you can perform the scan remotely from a single remote box with a modern operating system. – dawud Sep 17 '13 at 17:17
Furthermore, you can scan a whole subnet replacing the hostname with a target specified in CIDR notation. – dawud Sep 17 '13 at 17:21
I'll bear that in mind, but that doesn't fit my auditing process which implies running scripts on each machine. I could keep it as a workaround though, thanks. – mveroone Sep 18 '13 at 7:43
up vote 0 down vote accepted

Bob on the chat suggested to use a subshell, including sleep between two echoes.

This works like a charm :

( echo "EHLO `hostname`"; sleep 1; echo "QUIT" ) | telnet `hostname` 25

I can grep 220 now, and i'm quite sure to get the answer within the one second scope.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .