Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to catalog which smtp servers are used in an heterogenous pool of servers, and so far I was doing :

echo "HELO localhost"  | telnet localhost 25 2>/dev/null | grep 220
#process the output of command

My problem is the server doesn't always have time to answer "220 ..." before the socket is closed.

So I'm looking of a relatively short, bash-based script that would be a bit more reliable. I couldn't find an easy way to make the command wait a few seconds before closing the TCP connection.

I tried expect but i can't get it to work, and that requires an external file, which doesn't really fit in my auditing suite, and I can't be sure to have it available on all servers.

Any simple ideas ?

EDIT : versions (yep, old, I know):

  • bash-2.05b-41.7
  • coreutils-4.5.3-28.1
  • linux-2.4.21
share|improve this question
Just ping for a few packets, works great as an easy pause. :) – Ƭᴇcʜιᴇ007 Sep 17 '13 at 17:29
I don't get it. – mveroone Sep 18 '13 at 7:20

Use nmap(1) fingerprinting capabilities, from the manpage:

-sV: Probe open ports to determine service/version info

An example:

$ nmap -sV -p 25

Starting Nmap 6.40 ( ) at 2013-09-17 17:50 CEST
    Nmap scan report for (
Host is up (0.0052s latency).
25/tcp open  smtp    MailEnable smptd 7.08--7.08
Service Info: Host:; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at .
Nmap done: 1 IP address (1 host up) scanned in 13.67 seconds

I don't know if it is useful for you, but the output uses CPE.

share|improve this answer
Unfortunatly, nmap isn't available on most machines, and I can't install more softwares for this "project" needs'. – mveroone Sep 17 '13 at 16:04
You are not supposed to install it on every machine, you can perform the scan remotely from a single remote box with a modern operating system. – dawud Sep 17 '13 at 17:17
Furthermore, you can scan a whole subnet replacing the hostname with a target specified in CIDR notation. – dawud Sep 17 '13 at 17:21
I'll bear that in mind, but that doesn't fit my auditing process which implies running scripts on each machine. I could keep it as a workaround though, thanks. – mveroone Sep 18 '13 at 7:43
up vote 0 down vote accepted

Bob on the chat suggested to use a subshell, including sleep between two echoes.

This works like a charm :

( echo "EHLO `hostname`"; sleep 1; echo "QUIT" ) | telnet `hostname` 25

I can grep 220 now, and i'm quite sure to get the answer within the one second scope.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.