New feature in NMAP:
nmap -sV
from man page:
" -sV Version detection: Afer TCP and/or UDP ports are discovered
using one of the other scan methods, version detection communi-
cates with those ports to try and determine more about what is
actually running. A file called nmap-service-probes is used to
determine the best probes for detecting various services and the
match strings to expect. Nmap tries to determine the service
protocol (e.g. ftp, ssh, telnet, http), the application name
(e.g. ISC Bind, Apache httpd, Solaris telnetd), the version num-
ber, and sometimes miscellaneous details like whether an X
server is open to connections or the SSH protocol version). If
Nmap was compiled with OpenSSL support, it will connect to SSL
servers to deduce the service listening behind the encryption.
When RPC services are discovered, the Nmap RPC grinder is used
to determine the RPC program and version numbers. Note that the
Nmap -A option also enables this feature. For a much more
detailed description of Nmap service detection, read our paper
at
http://www.insecure.org/nmap/versionscan.html . There is a
related --version_trace option which causes Nmap to print out
extensive debugging info about what version scanning is doing
(this is a subset of what you would get with --packet_trace)."
