When Nmap does service version detection with -sV
, it tries to match output from the service to a fingerprint in the nmap-service-probes
file. If there is no match (often because there is no output), then the name of the service is pulled from the nmap-services
file based on the port number, and a ?
is appended to indicate that this is not a confident result. Port 443 is listed as "https" in nmap-services
.
In the process of service fingerprinting, sometimes the service is detected as SSL/TLS. In this case, the "service tunnel" is labeled ssl
and the service fingerprinting process starts over inside the encrypted tunnel. If you see ssl/https?
then it means that Nmap knows it's running some SSL-encrypted service, but it doesn't know what the service is, other than that it's running on port 443.
You should always use the latest version of Nmap to ensure that you have the latest updates to nmap-service-probes
. If you see a service that Nmap doesn't know yet, you can submit it.