Re: Service Identification

[Martin Mačok <martin.macok () underground cz>]

On Sun, Dec 07, 2003 at 11:21:01AM -0600, Beaty, Bryan wrote:

> Port 23 and 25 are open but cannot be identified by AMAP or NMAP.
> When I telnet <ip> 23 or 25 I get a blank screen.

You should use netcat (nc) instead of telnet to do this, because
telnet sends out some terminal control sequence too.

> Does this mean the telnet and SMTP server have crashed?

Probably not. If it crashes then the port is usually closed.

> Could it be that someone has installed some other service on these
> ports?

Maybe, try amapcrap ...

Is the connection closed (by the server) after some time? The port
could be somehow "tarpitted" ... or some sort of honeypot/IDS too.

-- 
         Martin Mačok                 http://underground.cz/
   martin.macok () underground cz        http://Xtrmntr.org/ORBman/

---------------------------------------------------------------------------
----------------------------------------------------------------------------