Re: Challenge identifying mainframe port
David Fifield <[email protected]>
| Newsgroups | gmane.comp.security.nmap.devel |
|---|---|
| Message-ID | <[email protected]> |
On Fri, Oct 20, 2017 at 09:04:01AM -0700, Phil wrote: > I’m testing a mainframe and this looks like it should be triggering the tn3270 > service detection but doesn’t work. I worked previously (sorry I can’t get more > specific than ‘previously’). Any suggestions on what I could change to make > this work? > > > PORT STATE SERVICE VERSION > 223/tcp open telnet > 1 service unrecognized despite returning data. If you know the service/ > version, please submit the following fingerprint at [1]https://nmap.org/ > cgi-bin/submit.cgi?new-service : > SF-Port223-TCP:V=7.60SVN%I=7%D=10/18%Time=59E78CD2%P=x86_64-unknown-linux > SF:-gnu%r(tn3270,12,"\xff\xfd\.\xff\xfd\x18\xff\xfe\x19\xff\xfc\x19\xff\xf > SF:e\0\xff\xfc\0"); It's running the tn3270 probe, but it looks like there are no match lines for this specific response. The first three bytes here are "\xff\xfd\x2e". The match lines in nmap-service-probes (r37060) start with "\xff\xfd\x18". Under the NULL probe there are also "\xff\xfd\x1d" and "\xff\xfd\x28", but no "\xff\xfd\x2e". _______________________________________________ Sent through the dev mailing list https://nmap.org/mailman/listinfo/dev Archived at http://seclists.org/nmap-dev/