Quick reminder for when Nmap finds an open port but can’t tell me what’s listening. More vs make the output noisier; they don’t make service detection try harder.

For an unknown service on port 9000:

nmap -sV --version-all --reason -p 9000 10.0.0.1

--version-all tries all service-detection probes. A service name inferred from the port number isn’t the same as a service identified from its response, so pay attention to how confident Nmap actually is.

If that still leaves questions, add the relevant scripts:

nmap -sV --reason --script="(safe or default) and not broadcast" -p 9000 10.0.0.1

My old one-liner misspelled default and put + in front of the expression. That prefix forces scripts to run even when their normal selection rules say they don’t apply. Useful occasionally, but a fairly blunt default for every mystery port. Also, default and safe are different categories; their union isn’t a promise that every selected script is non-intrusive.

The NSE reference explains the expression syntax. The version-detection options explain the probes.