What are those "unknown" services?
Those services are "unknown" because they are not listed in
services file, nmap uses that to map port numbers to services. On my system,
I found out where the file is located by doing (I am on devuan, a debian-based system like ubuntu or mint):
$ dpkg -L nmap
On RedHat/Suse based systems, you use
rpm -ql nmap.
How can I find them out? Is fuser supposed to find that out?
nmap's friend, for each, simply run
fuser <port>/<protocol> (the first column of what
nmap prints out):
$ fuser 41441/tcp
This will give you the pid of the process (above example, 1234) which you can pass to
$ ps 1234
PID TTY STAT TIME COMMAND
1234 ? Sl 169:39 /usr/lib/jvm/java-8-oracle/bin/java -Dnop -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager [...]
In my example, it is actually Apache Tomcat ...
Now, I searched for 41441 in
/usr/share/nmap/nmap-services and replaced the "unknown" with "tomcat":
Now, nmap detects my tomcat:
$ nmap -p0-65535 192.168.1.198
Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-19 23:32 EDT
Nmap scan report for olive.fios-router.home (192.168.1.198)
Host is up (0.00050s latency).
Not shown: 65526 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
139/tcp open netbios-ssn
445/tcp open microsoft-ds
2049/tcp open nfs
5900/tcp filtered vnc
41441/tcp open tomcat