Service and OS Detection

Knowing a port is open is not enough. You need to know what software is listening and its version, because exploits target specific versions.

Nmap's service detection and OS fingerprinting turn a list of open ports into actionable intelligence.

The -sV flag probes open ports and matches responses against Nmap's database to identify the service and version, for example 'OpenSSH 8.2p1' or 'Apache httpd 2.4.41'.

Nmap sends a series of probes and compares the responses (banners, behaviors, error messages) to thousands of signatures in nmap-service-probes.

This banner-grabbing and behavioral matching identifies services even on non-standard ports, like an HTTP server running on port 8000.

You can tune how hard Nmap tries with --version-intensity (0 to 9):

• Lower: fewer probes, faster, may miss versions.
• Higher: more probes, slower, more accurate.

Shortcuts: --version-light (intensity 2) and --version-all (intensity 9).

The -O flag enables OS fingerprinting. Nmap examines subtle differences in how a TCP/IP stack responds and matches them against its OS signature database.

It reports a best guess and an accuracy percentage, plus device type and uptime estimates when available.

Each OS implements TCP/IP slightly differently. Nmap probes characteristics such as:

• Initial TTL values.
• TCP window size.
• How the stack handles unusual flag combinations.
• TCP options ordering.

These tiny differences form a fingerprint unique enough to guess the OS family and version.

OS detection is a best guess, not a certainty. Accuracy drops when:

• A firewall filters the probes Nmap relies on.
• The host runs an unusual or virtualized stack.
• Only a few ports are open to fingerprint from.

The --osscan-guess option makes Nmap guess more aggressively when unsure.

In practice you combine detection options. The -A flag is a shortcut that enables OS detection, version detection, default scripts, and traceroute together.

The exact version drives your next step. With 'vsftpd 2.3.4' you immediately recall a famous backdoor; with 'Apache 2.4.49' you think of a path-traversal CVE.

Accurate version data lets you search for matching exploits instead of blindly trying attacks. It also feeds directly into the vulnerability section of your report.

Always save scan output for analysis and reporting. Nmap supports multiple formats:

• -oN normal text.
• -oX XML (for tools).
• -oG greppable.
• -oA all formats at once.

Sometimes you confirm a service manually. Connecting with a raw client and reading the greeting (banner) reveals the software and version directly.

Tools like netcat let you do this for plaintext services. It is a quick sanity check when Nmap's guess seems off, though many services now suppress or fake their banners to mislead attackers.

Identify the flag that does the most at once.

You learned fingerprinting:

• -sV detects service versions via probe/banner matching; tune with --version-intensity.
• -O performs OS detection using TCP/IP stack fingerprinting; results are best guesses.
• -A bundles OS, version, scripts, and traceroute.
• Exact versions guide exploit selection; save output with -oA.

Next: the Nmap Scripting Engine for deeper automation.