Re: Service Identification

From: Martin Mačok (martin.macok@underground.cz)
Date: Mon Dec 08 2003 - 05:30:26 EST


On Sun, Dec 07, 2003 at 11:21:01AM -0600, Beaty, Bryan wrote:

> Port 23 and 25 are open but cannot be identified by AMAP or NMAP.
> When I telnet <ip> 23 or 25 I get a blank screen.

You should use netcat (nc) instead of telnet to do this, because
telnet sends out some terminal control sequence too.

> Does this mean the telnet and SMTP server have crashed?

Probably not. If it crashes then the port is usually closed.

> Could it be that someone has installed some other service on these
> ports?

Maybe, try amapcrap ...

Is the connection closed (by the server) after some time? The port
could be somehow "tarpitted" ... or some sort of honeypot/IDS too.

-- 
         Martin Mačok                 http://underground.cz/
   martin.macok@underground.cz        http://Xtrmntr.org/ORBman/
---------------------------------------------------------------------------
----------------------------------------------------------------------------


This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:43 EDT