Post cover image

September 17, 2026

Nmap Learning Series — Part 3: OS and Service Version Scanning

In the previous parts of this series, we explored what Nmap is, why network scanning matters, and how to discover live hosts on a network.

By Subrat Samantaray

6 min read

Once a host is discovered, the next question is:

What is running on that host?

Finding an IP address is only the beginning of reconnaissance. To understand the target, we need to identify its operating system, discover the services running on open ports, and determine their versions.

This is where OS detection and service version detection become important.

All scans discussed in this article should only be performed against systems you own or have explicit authorization to test.

Why OS and Service Detection Matter

Consider a host with the following open ports:

22/tcp    open    ssh
80/tcp    open    http
443/tcp   open    https

Knowing that these ports are open tells us which services may be accessible, but it does not tell us much about the underlying system.

For example:

22/tcp    OpenSSH
80/tcp    Apache HTTP Server
443/tcp   Apache HTTP Server

If we can determine the versions of these services and identify the operating system, we can build a much more complete picture of the host.

This process is commonly referred to as fingerprinting.

OS Detection with Nmap

Nmap provides the -O option for operating system detection.

nmap -O 192.168.0.1

Here:

-O

enables Operating System Detection.

Nmap analyzes subtle differences in the way the target responds to specific network probes. These responses can provide clues about the operating system and device type.

For example, the target may be identified as a:

Linux system
Windows system
Router
Firewall
Network appliance

The exact output depends on the target and the available network responses.

How OS Detection Works

Operating systems implement networking protocols slightly differently.

Nmap can analyze characteristics of the target's TCP/IP responses and compare them against known fingerprints.

Conceptually:

Target Host
     |
     v
Nmap sends probes
     |
     v
Target responds
     |
     v
Nmap analyzes TCP/IP behavior
     |
     v
Fingerprint comparison
     |
     v
Possible OS identification

This is useful during reconnaissance because knowing the operating system can help us understand the type of environment we are dealing with.

OS Detection Example

nmap -O 192.168.0.1

A successful scan can provide information such as:

OS details
Device type
OS fingerprint

However, OS detection is not guaranteed.

Firewalls, packet filtering, restrictive configurations, and other network conditions can interfere with the probes Nmap uses.

OS detection also generally requires root/administrator privileges for accurate results.

Service Version Detection

Identifying an open port is useful, but knowing what service and version is running on that port provides much more context.

Nmap provides the -sV option for Service Version Detection.

nmap -sV 192.168.0.1

The scan probes open ports and attempts to identify the services running on them and their versions.

For example:

22/tcp    open    ssh     OpenSSH
80/tcp    open    http    Apache HTTP Server

Depending on the target, Nmap may be able to identify more detailed version information.

Combining OS and Service Detection

We can combine both techniques:

nmap -O -sV 192.168.0.1

Here:

-O    → OS detection
-sV   → Service version detection

This gives us information about both the operating system and services running on the target.

The basic reconnaissance flow becomes:

Target IP
   |
   v
Discover Host
   |
   v
Identify Open Ports
   |
   v
Identify Services
   |
   v
Identify Service Versions
   |
   v
Identify Operating System

This provides considerably more information than a simple port scan.

Why Version Detection Is Important

Suppose we discover:

80/tcp open http

This tells us that an HTTP service is accessible.

Now compare that with:

80/tcp open http Apache HTTP Server

The second result gives us additional information that can be used during security assessment.

Version information can help security professionals:

  • Understand the software stack
  • Identify outdated software
  • Research known vulnerabilities
  • Determine potential attack surface
  • Plan appropriate security testing
  • Prioritize further investigation

The important point is that version detection is primarily about building context around the exposed service.

OS + Service Version Scanning

A common combination is:

nmap -O -sV 192.168.0.1

The resulting information can conceptually look like:

Host: 192.168.0.1
Operating System:
    Linux
Open Ports:
    22/tcp
    80/tcp
    443/tcp
Services:
    SSH
    HTTP
    HTTPS
Service Versions:
    OpenSSH
    Apache HTTP Server

The exact results will depend entirely on the target.

Aggressive Scanning with -A

Nmap also provides the -A option for Aggressive Scan.

nmap -A 192.168.0.1

The -A option enables several advanced detection features, including:

OS detection
Service version detection
Default script scanning
Traceroute

In other words, instead of manually combining multiple options, -A enables several of these capabilities together.

Conceptually:

-A
 |
 +-- OS Detection
 |
 +-- Service Version Detection
 |
 +-- Default NSE Scripts
 |
 +-- Traceroute

This can provide a much more detailed view of the target.

Scanning the Full Port Range

By default, Nmap commonly scans its top 1,000 TCP ports.

But what if a service is running on a port outside that range?

This is where:

-p-

becomes useful.

The -p- option tells Nmap to scan the complete TCP port range:

1–65535

For example:

nmap -p- 192.168.0.1

This can reveal services running on less commonly used ports.

Combining Aggressive Scanning with Full Port Scanning

We can combine -A and -p-:

nmap -A 192.168.0.1 -p-

This tells Nmap to perform aggressive detection while scanning the full TCP port range.

The resulting reconnaissance can include:

Open ports
Service information
Service versions
OS fingerprinting
Default NSE script results
Traceroute information

This makes it useful when a more comprehensive picture of an authorized target is required.

Understanding the Reconnaissance Flow

At this point, our Nmap workflow can become much more structured.

Target
                      |
                      v
              Host Discovery
                      |
                      v
               Port Scanning
                      |
                      v
             Open Port Found
                      |
                      v
            Service Detection
                      |
                      v
           Version Detection
                      |
                      v
              OS Detection
                      |
                      v
          Further Enumeration

Each stage answers a different question.

Host Discovery

Question:

Is the host alive?

Port Scanning

Question:

Which ports are accessible?

Service Detection

Question:

What service is running?

Version Detection

Question:

Which version of the service is running?

OS Detection

Question:

What operating system or device is likely behind the service?

This gradual process is much more useful than immediately throwing every available scan option at a target.

Choosing the Right Scan

Different situations call for different levels of scanning.

CommandPurposeInformationnmap -O 192.168.0.1OS detectionOperating system and device informationnmap -O -sV 192.168.0.1OS + version detectionOS and service version informationnmap -A 192.168.0.1 -p-Comprehensive scanPorts, services, versions, OS, scripts and traceroute

The choice depends on the goal of the assessment.

A Practical Lab Scenario

Imagine you are auditing a Linux server in your own lab.

You already discovered:

192.168.0.10

Instead of immediately attempting exploitation, begin by understanding the host.

Step 1 — Identify the operating system

nmap -O 192.168.0.10

You may receive information indicating that the target is likely a Linux-based system.

Step 2 — Identify service versions

nmap -sV 192.168.0.10

Now you can investigate which services are exposed and which versions they appear to use.

Step 3 — Combine both

nmap -O -sV 192.168.0.10

You now have a better fingerprint of the system.

Step 4 — Perform broader reconnaissance

If a comprehensive scan is appropriate for your authorized lab:

nmap -A 192.168.0.10 -p-

This can reveal additional ports and provide more detailed information about the system.

The overall process becomes:

192.168.0.10
      |
      +--> OS Detection
      |
      +--> Open Ports
      |
      +--> Services
      |
      +--> Service Versions
      |
      +--> NSE Information
      |
      +--> Traceroute

Detection vs Exploitation

An important concept in penetration testing is separating reconnaissance from exploitation.

Nmap helps us gather information.

For example:

Target
  |
  v
Reconnaissance
  |
  +--> Ports
  |
  +--> Services
  |
  +--> Versions
  |
  +--> OS
  |
  v
Enumeration
  |
  v
Vulnerability Assessment
  |
  v
Authorized Exploitation

Finding a particular service version does not automatically mean the target is vulnerable.

It simply gives us information that can be investigated further.

Noise and Detection

There is also an operational consideration when using aggressive scans.

A command such as:

nmap -A 192.168.0.1 -p-

generates considerably more scanning activity than a basic host discovery scan.

It can therefore be more noticeable to security monitoring systems such as IDS/IPS and firewalls.

Full-range scanning can also take significantly longer depending on network conditions and target configuration.

This is an important lesson for anyone learning penetration testing:

More information usually requires more probing.

Understanding the visibility and impact of a scan is just as important as knowing the command itself.

Key Takeaways

The most important Nmap options covered in this part are:

-O

Used for operating system detection.

-sV

Used for service and version detection.

-A

Enables aggressive scanning features including OS detection, version detection, default scripts, and traceroute.

-p-

Scans the full TCP port range from 1 to 65535.

A practical progression is:

nmap -O <target>

then:

nmap -O -sV <target>

and, when a comprehensive scan is appropriate:

nmap -A <target> -p-

Final Thoughts

Nmap becomes much more powerful when we stop looking at it as simply a port scanner.

A port tells us that something is listening.

A service tells us what is listening.

A version tells us more specifically what software is running.

OS detection provides additional context about the underlying system.

Together, these pieces form a useful fingerprint of the target:

IP Address
    |
    v
Open Ports
    |
    v
Services
    |
    v
Versions
    |
    v
Operating System
    |
    v
Attack Surface Understanding

This information becomes the foundation for the next stages of security assessment: enumeration, vulnerability analysis, and controlled testing.

In the next part, we'll go deeper into Nmap NSE scripts and how scripting can extend Nmap beyond basic scanning.

Commands Covered

# OS detection
nmap -O 192.168.0.1
# Service version detection
nmap -sV 192.168.0.1
# OS + service version detection
nmap -O -sV 192.168.0.1
# Aggressive scan
nmap -A 192.168.0.1
# Aggressive scan + full TCP port range
nmap -A 192.168.0.1 -p-

Lab responsibly. Scan only systems you own or have explicit permission to assess.