1

I run nmap on a Lubuntu machine using its own private IP address.

What are those "unknown" services?

How can I find them out? Is fuser supposed to find that out?

Thanks.

$ nmap -p0-65535 192.168.1.198

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-19 23:32 EDT
Nmap scan report for olive.fios-router.home (192.168.1.198)
Host is up (0.00050s latency).
Not shown: 65526 closed ports
PORT      STATE    SERVICE
22/tcp    open     ssh
111/tcp   open     rpcbind
139/tcp   open     netbios-ssn
445/tcp   open     microsoft-ds
2049/tcp  open     nfs
5900/tcp  filtered vnc
41441/tcp open     unknown
43877/tcp open     unknown
44847/tcp open     unknown
55309/tcp open     unknown

Nmap done: 1 IP address (1 host up) scanned in 6.22 seconds
5

What are those "unknown" services?

Those services are "unknown" because they are not listed in nmap's services file, nmap uses that to map port numbers to services. On my system, nmap uses /usr/share/nmap/nmap-services.

I found out where the file is located by doing (I am on devuan, a debian-based system like ubuntu or mint):

$ dpkg -L nmap

On RedHat/Suse based systems, you use rpm -ql nmap.

How can I find them out? Is fuser supposed to find that out?

fuser is nmap's friend, for each, simply run fuser <port>/<protocol> (the first column of what nmap prints out):

$ fuser 41441/tcp
41441/tcp 1234

This will give you the pid of the process (above example, 1234) which you can pass to ps

 $ ps 1234

 PID TTY      STAT   TIME COMMAND
 1234 ?        Sl   169:39 /usr/lib/jvm/java-8-oracle/bin/java -Dnop -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager [...]

In my example, it is actually Apache Tomcat ...

Now, I searched for 41441 in /usr/share/nmap/nmap-services and replaced the "unknown" with "tomcat":

tomcat        41441/tcp

Now, nmap detects my tomcat:

$ nmap -p0-65535 192.168.1.198

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-19 23:32 EDT
Nmap scan report for olive.fios-router.home (192.168.1.198)
Host is up (0.00050s latency).
Not shown: 65526 closed ports
PORT      STATE    SERVICE
22/tcp    open     ssh
111/tcp   open     rpcbind
139/tcp   open     netbios-ssn
445/tcp   open     microsoft-ds
2049/tcp  open     nfs
5900/tcp  filtered vnc
41441/tcp open     tomcat

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.