Network Recon & Service Detection

From open ports to a service map

Knowing port 22 is open is barely useful — anything can listen on any port. Service detection identifies the actual software and version, which is what maps to vulnerabilities:

graph LR
SCAN["open ports<br/>22, 80, 8080"] --> PROBE["probe each<br/>(banner + protocol)"]
PROBE --> ID["identify service+version<br/>OpenSSH 8.2 · nginx 1.18"]
ID --> OS["OS fingerprint<br/>(TTL, window, options)"]
OS --> MAP["recon report<br/>(hosts → services → risks)"]

Two techniques do most of the work:

• Banner & protocol probing. Read what a service announces on connect, or send a protocol-specific request and read the reply. SSH and SMTP greet you with a version; HTTP answers a HEAD with a Server header. (port scanning showed the raw banner read.)
• OS fingerprinting. A host’s TCP/IP stack leaks its OS through defaults: initial TTL (≈64 Linux/macOS, ≈128 Windows), default window size, and TCP option ordering. Observe those and you can often guess the OS — passively, without an unusual packet.

See it: build a recon report

Recon is synthesis — correlate observations into a picture and flag what’s risky. This runs here: it classifies services from (port, banner) observations, infers the OS from a TTL, and reports outdated software, exactly as a recon tool’s output stage does:

package main

import (
"fmt"
"sort"
"strings"
)

type obs struct {
port   int
banner string
}

func classify(o obs) (service, note string) {
b := strings.ToLower(o.banner)
switch {
case strings.Contains(b, "openssh"):
	service = "SSH"
	if strings.Contains(b, "7.") {
		note = "OUTDATED — upgrade"
	}
case strings.Contains(b, "nginx"), strings.Contains(b, "apache"):
	service = "HTTP server"
case strings.Contains(b, "mysql"):
	service = "database (EXPOSED!)"
default:
	service = "unknown"
}
return
}

func osFromTTL(ttl int) string {
switch {
case ttl <= 64:
	return "Linux/macOS (TTL~64)"
case ttl <= 128:
	return "Windows (TTL~128)"
default:
	return "network device (TTL~255)"
}
}

func main() {
host := "10.0.0.5"
observations := []obs{
	{22, "SSH-2.0-OpenSSH_7.4"},
	{80, "nginx/1.18.0"},
	{3306, "5.7.33-MySQL"},
}
fmt.Printf("host %s — likely %s\n", host, osFromTTL(64))
sort.Slice(observations, func(i, j int) bool { return observations[i].port < observations[j].port })
for _, o := range observations {
	svc, note := classify(o)
	line := fmt.Sprintf("  %d/tcp  %-18s %s", o.port, svc, o.banner)
	if note != "" {
		line += "  <-- " + note
	}
	fmt.Println(line)
}
}

The report flags an outdated OpenSSH and a database exposed to the network — the two findings a defender most wants surfaced. Real tools (nmap with -sV/-O) automate the probing; the value you add is correlation and prioritization.

Pivoting and the TCP proxy

A TCP proxy copies bytes bidirectionally between two connections — io.Copy in each direction. It’s a legitimate building block (tunnels, load balancers, dev proxies), and it’s also how an attacker who has compromised one host pivots to reach internal systems by relaying through their foothold (fenced — needs real sockets):

// A minimal TCP forwarder: client <-> destination.
func handle(client net.Conn) {
	dst, err := net.Dial("tcp", "internal-host:5432")
	if err != nil { client.Close(); return }
	go io.Copy(dst, client) // client -> destination
	io.Copy(client, dst)    // destination -> client
}

Knowing this shape helps defenders too: an outbound connection from a DMZ web server to an internal database, relayed through a process that shouldn’t be proxying, is a classic pivot signature worth alerting on.

See also

• Port scanning — finding the open ports recon then characterizes.
• DNS enumeration — the hostnames that complete the map.
• HTTP recon — deep service detection for web servers.
• Packet analysis — the TTL/window signals behind OS fingerprinting.

Next: discovering the hosts and names that make up a target — DNS enumeration.

Related topics