Re: Challenge identifying mainframe port

[David Fifield <david () bamsoftware com>]

On Fri, Oct 20, 2017 at 09:04:01AM -0700, Phil wrote:
> I’m testing a mainframe and this looks like it should be triggering the tn3270
> service detection but doesn’t work. I worked previously (sorry I can’t get more
> specific than ‘previously’). Any suggestions on what I could change to make
> this work? 
>
>
>     PORT     STATE SERVICE VERSION
>     223/tcp open  telnet
>     1 service unrecognized despite returning data. If you know the service/
>     version, please submit the following fingerprint at [1]https://nmap.org/
>     cgi-bin/submit.cgi?new-service :
>     SF-Port223-TCP:V=7.60SVN%I=7%D=10/18%Time=59E78CD2%P=x86_64-unknown-linux
>     SF:-gnu%r(tn3270,12,"\xff\xfd\.\xff\xfd\x18\xff\xfe\x19\xff\xfc\x19\xff\xf
>     SF:e\0\xff\xfc\0");

It's running the tn3270 probe, but it looks like there are no match
lines for this specific response. The first three bytes here are
"\xff\xfd\x2e". The match lines in nmap-service-probes (r37060) start
with "\xff\xfd\x18".

Under the NULL probe there are also "\xff\xfd\x1d" and "\xff\xfd\x28",
but no "\xff\xfd\x2e".
_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/