Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to catalog which smtp servers are used in an heterogenous pool of servers, and so far I was doing :

echo "HELO localhost"  | telnet localhost 25 2>/dev/null | grep 220
#process the output of command

My problem is the server doesn't always have time to answer "220 ..." before the socket is closed.

So I'm looking of a relatively short, bash-based script that would be a bit more reliable. I couldn't find an easy way to make the command wait a few seconds before closing the TCP connection.

I tried expect but i can't get it to work, and that requires an external file, which doesn't really fit in my auditing suite, and I can't be sure to have it available on all servers.

Any simple ideas ?

EDIT : versions (yep, old, I know):

  • bash-2.05b-41.7
  • coreutils-4.5.3-28.1
  • linux-2.4.21
share|improve this question
    
Just ping 127.0.0.1 for a few packets, works great as an easy pause. :) –  techie007 Sep 17 '13 at 17:29
    
I don't get it. –  Kwaio Sep 18 '13 at 7:20
add comment

2 Answers

Use nmap(1) fingerprinting capabilities, from the manpage:

SERVICE/VERSION DETECTION:
-sV: Probe open ports to determine service/version info

An example:

$ nmap -sV some.mail.server.biz -p 25

Starting Nmap 6.40 ( http://nmap.org ) at 2013-09-17 17:50 CEST
    Nmap scan report for some.mail.server.biz (10.0.0.135)
Host is up (0.0052s latency).
PORT   STATE SERVICE VERSION
25/tcp open  smtp    MailEnable smptd 7.08--7.08
Service Info: Host: some.domain.com; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.67 seconds

I don't know if it is useful for you, but the output uses CPE.

share|improve this answer
    
Unfortunatly, nmap isn't available on most machines, and I can't install more softwares for this "project" needs'. –  Kwaio Sep 17 '13 at 16:04
    
You are not supposed to install it on every machine, you can perform the scan remotely from a single remote box with a modern operating system. –  dawud Sep 17 '13 at 17:17
    
Furthermore, you can scan a whole subnet replacing the hostname with a target specified in CIDR notation. –  dawud Sep 17 '13 at 17:21
    
I'll bear that in mind, but that doesn't fit my auditing process which implies running scripts on each machine. I could keep it as a workaround though, thanks. –  Kwaio Sep 18 '13 at 7:43
add comment
up vote 0 down vote accepted

Bob on the chat suggested to use a subshell, including sleep between two echoes.

This works like a charm :

( echo "EHLO `hostname`"; sleep 1; echo "QUIT" ) | telnet `hostname` 25

I can grep 220 now, and i'm quite sure to get the answer within the one second scope.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.