I'm trying to analyze the behavior of an IP that works as free WiFi access point. nmap with parameter (-sV) reports the following for two different measurements:

PORT STATE SERVICE VERSION 443/tcp open ssl/https?

PORT STATE SERVICE VERSION 443/tcp open https?

Why does one show up as ssl/https? while the other is just https??

  • is this reproducable? could you provide us the data traffic generated by nmap, i.e. the file /tmp/for_ul_se.pcap generated by tcpdump -i <your_wlan_interface_name> -s0 -w/tmp/for_ul_se.pcap port 443? – Bananguin Sep 8 '14 at 22:35

In looking through the online help for nmap I found the following description for services that are prefixed with ssl/.

excerpt from - http://nmap.org/book/vscan-fileformat.html#vscan-db-ports

This is simply the service name that the pattern matches. Examples would be ssh, smtp, http, or snmp. As a special case, you can prefix the service name with ssl/, as in ssl/vmware-auth. In that case, the service would be stored as vmware-auth tunneled by SSL. This is useful for services which can be fully recognized without the overhead of making an SSL connection.


  • but it is due to a measurement of results with ssl and without ssl another? in detail that is? ... packet loss? – alvaroiv Sep 9 '14 at 2:56
  • I suspect that one of the AP's is using an older set of SSL cipher suites, say SSLv2 vs. SSLv3 (TLSv1). You have to make use of additional switching as described in the reference url that I provided to confirm this though. – slm Sep 9 '14 at 2:59
  • When doing what you told me, it gives me this result: PORT STATE SERVICE 443/tcp open https – alvaroiv Sep 9 '14 at 3:23
  • one last question @slm ... As I can describe in detail the different results specifically? In some cases, it may be due to packet loss when running nmap? – alvaroiv Sep 10 '14 at 5:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.