Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is this feasible? Can I find out which distro is used to host specific webpages? Whois doesn't have info for this.

share|improve this question
add comment

2 Answers

nmap can detect/guess operating system information of remote server.

OS Detection

One of Nmap's best-known features is remote OS detection using TCP/IP stack fingerprinting. Nmap sends a series of TCP and UDP packets to the remote host and examines practically every bit in the responses. After performing dozens of tests such as TCP ISN sampling, TCP options support and ordering, IP ID sampling, and the initial window size check, Nmap compares the results to its nmap-os-db database of more than 2,600 known OS fingerprints and prints out the OS details if there is a match. Each fingerprint includes a freeform textual description of the OS, and a classification which provides the vendor name (e.g. Sun), underlying OS (e.g. Solaris), OS generation (e.g. 10), and device type (general purpose, router, switch, game console, etc). Most fingerprints also have a Common Platform Enumeration (CPE) representation, like cpe:/o:linux:kernel:2.6.


[root@liuyan liuyan]# nmap -A -T4 www.kernel.org

Starting Nmap 6.01 ( http://nmap.org ) at 2012-11-07 21:18 CST
Nmap scan report for www.kernel.org (
Host is up (0.31s latency).
Other addresses for www.kernel.org (not scanned):
Not shown: 990 closed ports
21/tcp   open     ftp            vsftpd 2.3.4
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| drwxrwx---    2 536      528          4096 May 21  2001 for_mirrors_only
| drwxr-xr-x   11 536      536          4096 Dec 01  2011 pub
|_lrwxrwxrwx    1 0        0              10 Apr 21  2007 welcome.msg -> pub/README
22/tcp   open     ssh            OpenSSH 5.8 (protocol 2.0)
| ssh-hostkey: 1024 01:6f:7b:00:d2:78:e7:68:ef:68:e0:5e:c7:ee:42:28 (DSA)
|_2048 d4:2a:5b:81:00:a9:e9:b2:75:8c:af:40:ee:a0:1b:8e (RSA)
80/tcp   open     http           Apache httpd 2.2.22 ((Fedora))
| http-methods: Potentially risky methods: TRACE
|_See http://nmap.org/nsedoc/scripts/http-methods.html
135/tcp  filtered msrpc
139/tcp  filtered netbios-ssn
443/tcp  open     ssl/http       Apache httpd 2.2.22 ((Fedora))
| http-methods: Potentially risky methods: TRACE
|_See http://nmap.org/nsedoc/scripts/http-methods.html
| http-robots.txt: 16 disallowed entries (15 shown)
| /cgi-bin/ /pub/mirrors/ /pub/scm/ 
| /mirrors/process-registration.cgi /lsb/ /linuxeda/ /os.org/ /debian/ /debian-cd/ /lanana/ 
|_/li18nux/ /freestandards/ /filehub/ /diff/ /git/
| ssl-cert: Subject: commonName=*.kernel.org/organizationName=The Linux Kernel Organization/stateOrProvinceName=California/countryName=US
| Not valid before: 2012-01-03 00:00:00
|_Not valid after:  2014-04-03 23:59:59
|_http-title: The Linux Kernel Archives
445/tcp  filtered microsoft-ds
593/tcp  filtered http-rpc-epmap
873/tcp  open     rsync          (protocol version 30)
4444/tcp filtered krb524
Device type: general purpose|storage-misc|WAP|media device|webcam
Running (JUST GUESSING): Linux 2.6.X|3.X|2.4.X (92%), HP embedded (89%), Netgear embedded (87%), Western Digital embedded (87%), Linksys Linux 2.4.X (86%), AXIS Linux 2.6.X (85%), Asus Linux 2.6.X (85%)
OS CPE: cpe:/o:linux:kernel:2.6 cpe:/o:linux:kernel:3 cpe:/o:linux:kernel:2.6.22 cpe:/o:linksys:linux:2.4 cpe:/o:linux:kernel:2.4 cpe:/o:axis:linux:2.6 cpe:/h:asus:rt-n16 cpe:/o:asus:linux:2.6
Aggressive OS guesses: Linux 2.6.32 (92%), Linux 2.6.32 - 2.6.38 (90%), HP P2000 G3 NAS device (89%), Linux 2.6.22 - 2.6.36 (87%), Linux 2.6.23 - 2.6.38 (87%), Linux 2.6.31 - 2.6.35 (87%), Linux 3.0 (87%), Linux 2.6.32 - 2.6.39 (87%), Linux 2.6.39 (87%), Netgear DG834G WAP or Western Digital WD TV media player (87%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 17 hops
Service Info: OS: Unix

TRACEROUTE (using port 1723/tcp)
-   Hops 1-6 are the same as for
7   ... 8
9   35.89 ms (
10  13.22 ms
11  10.99 ms
12  19.59 ms
13  166.83 ms
14  286.39 ms
15  301.44 ms
16  ...
17  328.42 ms pub2.kernel.org (
share|improve this answer
Yes - nmap is frightening. I will give you an OS-guess, just by looking at the way the IP-stack responds. –  Nils Nov 7 '12 at 21:31
add comment

If you have access to the server, you can try to get files /etc/issue and/or /etc/issue.net - eg with a scripting language.

If you don't have access to it, try examine the webserver headers:

wget -Sq -O /dev/null http://www.example.org
share|improve this answer
I don't have access. Was wondering if I can find that out, only from the url info.. –  tux_drummer Nov 7 '12 at 12:55
@tux_drummer the above method (wget) will work, if the sysadmin has not disabled that information on the webserver (which is recommended to avoid specifc security attacks). –  Nils Nov 7 '12 at 21:29
The URL doesn't tell you anything about the O/S you are connecting to. The response headers may tell you what O/S is in use, or they may provide a complete falsehood if the administrator chooses. –  BillThor Nov 8 '12 at 13:31
@BillThor true, there is no way how to find out the OS... even the nmap does only guess the OS. –  Kamil Šrot Nov 8 '12 at 20:09
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.