Take the 2-minute tour ×
$ time nmap -q -sV -P0 -p80 google.com | fgrep '80/tcp open'
80/tcp open  http    Google httpd 2.0 (GFE)

real    0m6.563s
user    0m0.280s
sys 0m0.016s

Are there any faster methods to get info about the webserver?

Google httpd 2.0 (GFE) is enough

share|improve this question
What information do you want? More precisely, for what purpose do you intend to use it? nmap gives you information based on its database of server response fingerprints. That doesn't let the server disguise itself except in specific reaction to nmap. Is that what you want? Or is the server's own declaration of who it is enough information? –  Gilles Jun 8 '11 at 20:38
Oh, and please learn to use tags already. We have over a thousand to choose from! Your question isn't remotely related to Linux. –  Gilles Jun 8 '11 at 20:40
as I described it: "get info about the webserver" - "Google httpd 2.0 (GFE) is enough" - how can I say it more precisely, that e.g.: "Apache 2" etc. what's not clear in this? just say it, and I will update! –  LanceBaynes Jun 9 '11 at 9:42
add comment

2 Answers

up vote 0 down vote accepted

For most HTTP servers, Nmap simply grabs the Server header, so that could be enough. To get that information, try this:

printf "HEAD / HTTP/1.0\r\nHost: $TARGET\r\n\r\n" | nc $TARGET 80 | awk '$1=="Server:"{$1="";print}'

Otherwise, if you want to use Nmap, there are some ways you could speed things up.

  • Use -n to avoid doing name resolution
  • Use --version-light or --version-intensity 0 to reduce the number of probes sent. This won't have an effect for most HTTP servers, since the default probe is usually the one that matches.
  • Use -Pn to skip host discovery. You already have this as -P0, which works, but is older syntax.

All together, these will save a few milliseconds. Unfortunately, the 6 seconds that you are seeing is Nmap waiting for the server to send data first. Nmap tries service detection probes in a particular order: first the NULL probe (wait for server to send first), then any probes that are "for" the port being scanned, then any other probes with a rarity less than the version intensity (default 7). The probes and their ports and rarities are defined in the nmap-service-probes file, which you could edit. This is a global setting, though, so you will be making Nmap less useful for general version detection if you edit it. Find the Probe TCP NULL line, and change the totalwaitms value below it to something small, like 100. It should look something like this:

Probe TCP NULL q||
# Wait for at least 6 seconds for data.  It used to be 5, but some
# smtp services have lately been instituting an artificial pause (see
# FEATURE('greet_pause') in Sendmail, for example)
totalwaitms 100

To avoid messing up Nmap for all other scans, make a copy of the nmap-service-probes file and refer to its location with the --datadir option. Here is the result I got:

$ time nmap -Pn -sV -n -p80 $TARGET --datadir=. | grep '^80/tcp'
80/tcp open  http    Google httpd 2.0 (GFE)

real    0m0.753s
user    0m0.472s
sys     0m0.032s
share|improve this answer
add comment

How about:

wget -q -O /dev/null -S www.google.com
share|improve this answer
I suppose you mean … | grep Server? That says what the server reports, which is a little different from nmap's fingerprinting. –  Gilles Jun 8 '11 at 20:36
add comment

Your Answer


