Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have several questions about nmap. First, nmap can detect servers via:

  • link-layer
  • network-layer
  • transport-layer

What are the differences (not in the layer, but in the way that nmap does it) and how does nmap do this?

Second, when I port scan with nmap, the UDP scan takes much longer then the TCP scan. Why?

Third: are there any different methods to explore the OS then to use the -O --osscan-guess command (I mean totally different, not e.)?

share|improve this question
I strongly suggest asking one question per question. Further, a lot of these are answered in the manpage—have you read it? I believe it answers your first two questions in depth. – derobert Dec 9 '11 at 17:14

I can address your third question.

One totally different way to identify an operating system is using Michal Zalewski's p0f. p0f guesses operating systems based on particular flags and other characteristics of TCP packets that pass by. A SYN packet from an incoming connection is enough to make a guess. The "fingerprint" file from Zalewski's site is kind of old. Newer fingerprint files exist.

share|improve this answer
Actually, this isn't right. A UDP packet sent to a closed port does send a reply (but those replies are rate limited, which is the major cause of slowness). Packet loss is a pretty minor problem (except on broken networks). If you look under -sU in the nmap manpage, there are several paragraphs answering that question. – derobert Dec 9 '11 at 17:47

I assume that you don't want to look into the source code because of its complexity. A book that describes in a simple way how nmap functions and what are the differences between its scanning techniques is Secrets of Network Cartography: A Comprehensive Guide to nmap (available online for free). For more documentation, check the docs on nmap.org

share|improve this answer

The short answers to your questions are below. The long answer is, "read the manpage." The Really Long Answer is, check out the source code.

  1. Host discovery ("detect servers")

    For hosts on the same link as the scanner, Nmap uses ARP requests to determine the link-layer address of each IP address being scanned. Any positive reply is taken to mean that the host is up. The --send-ip option can be used to override this behavior.

    For all other hosts, Nmap uses a combination of ICMP and TCP packets to attempt to solicit a response. This could be described as "network-layer" or even "transport-layer" discovery. Briefly, an ICMP Echo request should produce a Echo response, a TCP SYN should produce a TCP SYN-ACK or RST, a TCP ACK should produce a TCP RST, and an ICMP timestamp request should produce a timestamp response.

  2. UDP takes longer to scan because an open port does not have to return a reply. TCP scans can expect an immediate reply, whether open or closed, for each port that is not firewalled (filtered). UDP scans get the same reply for open and filtered ports (with some exceptions. See the documentation on UDP payloads). Furthermore, many hosts rate-limit the closed-port response (ICMP port unreachable response), so even closed ports can only be determined slowly.

  3. Some services running on a target system can divulge the Operating System, so running a service version scan (-sV) could give that information. Also, many of the NSE scripts that come with Nmap can get similar information. However, these methods are often less reliable than using -O, and depend on particular services being available.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.