2

I'm trying to analyze the behavior of IPs that operate as free WiFi hotspots. nmap -sV reports the following for two different hosts:

PORT STATE SERVICE VERSION 443/tcp open ssl/https?

PORT STATE SERVICE VERSION 443/tcp open https?

Why does one show up as ssl/https? while the other is just https??

Improve this question
3

When Nmap does service version detection with -sV, it tries to match output from the service to a fingerprint in the nmap-service-probes file. If there is no match (often because there is no output), then the name of the service is pulled from the nmap-services file based on the port number, and a ? is appended to indicate that this is not a confident result. Port 443 is listed as "https" in nmap-services.

In the process of service fingerprinting, sometimes the service is detected as SSL/TLS. In this case, the "service tunnel" is labeled ssl and the service fingerprinting process starts over inside the encrypted tunnel. If you see ssl/https? then it means that Nmap knows it's running some SSL-encrypted service, but it doesn't know what the service is, other than that it's running on port 443.

You should always use the latest version of Nmap to ensure that you have the latest updates to nmap-service-probes. If you see a service that Nmap doesn't know yet, you can submit it.

Improve this answer
4
  • thank @bonsaiviking! And that depends on the service detects it or not? Receiver hardware? version of nmap? that detects and avece sometimes not? sorry so many questions. – alvaroiv Sep 9 '14 at 5:08
  • @alvaroiv Newer versions of Nmap send more probes and understand more responses. Your OpenSSL version can affect things, too, since that's what Nmap uses to detect the SSL tunnel. Hardware doesn't usually matter. – bonsaiviking Sep 9 '14 at 17:22
  • one last question @bonsaiviking... In some cases, it may be due to packet loss when running nmap? – alvaroiv Sep 10 '14 at 5:46
  • @alvaroiv Yes, it could be, but Nmap has very good algorithms for detecting packet loss and correcting for it. – bonsaiviking Sep 10 '14 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.