Re: customizing nmap-services

[Tom Sellers <nmap () fadedcode net>]

On 9/24/10 7:20 PM, Ryan Giobbi wrote:
> Whenever I add a custom entry in nmap-services the scan results look like
> the below, even though I didn't put in the ? in the nmap-services file.
>
> 9999/tcp  open          test-output?
>
> Is this expected?

Ryan,
        Yes, this is expected behavior.  The ? indicates that nmap knows
what service the port is registered[1] for but has not verified that what is
listening there is indeed what was listed in the nmap-services file.  If
the version detection engine knew how to detect that service and successfully
did so the ? would go away.

I hope that helps.

Tom


1: The nmap-services file functions just the way that /etc/services or
%WINDIR%/System32/drivers/etc/services does in that is merely serves as a
listing of what service names have been registered with IANA for a particular
set of ports.   The nmap-services file has been augmented a touch so that
it includes frequency data as well as updates to reflect what the devs are
seeing out in the wild.

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/