ssl/irc not detected

[Matt Selsky <selsky () columbia edu>]

IRC servers running behind SSL don't seem to be detected as such.
freenode runs non-SSL on port 6667, and SSL on port 7000 and 7070.

$ ./nmap --datadir=. -d -sV -p 6667,7000,7070 --version-trace
irc.freenode.net

Starting Nmap 5.35DC18 ( http://nmap.org ) at 2010-11-10 17:06 PST
Fetchfile found ./nmap-services
The max # of sockets we are using is: 0
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
Fetchfile found ./nse_main.lua
Fetchfile found ./nselib/
Fetchfile found ./scripts/script.db
Fetchfile found ./scripts/db2-das-info.nse
Fetchfile found ./scripts/drda-info.nse
Fetchfile found ./scripts/iax2-version.nse
Fetchfile found ./scripts/jdwp-version.nse
Fetchfile found ./scripts/pptp-version.nse
Fetchfile found ./scripts/skypev2-version.nse
Fetchfile found ./scripts/wdb-version.nse
NSE: Loaded 7 scripts for scanning.
NSE: Loaded './scripts/db2-das-info.nse'.
NSE: Loaded './scripts/drda-info.nse'.
NSE: Loaded './scripts/iax2-version.nse'.
NSE: Loaded './scripts/jdwp-version.nse'.
NSE: Loaded './scripts/pptp-version.nse'.
NSE: Loaded './scripts/skypev2-version.nse'.
NSE: Loaded './scripts/wdb-version.nse'.
Fetchfile found ./nmap-payloads
Initiating Ping Scan at 17:06
Scanning irc.freenode.net (82.96.64.4) [2 ports]
ultrascan_host_probe_update called for machine 82.96.64.4 state UNKNOWN
-> HOST_UP (trynum 0 time: 169050)
Changing ping technique for 82.96.64.4 to connect to port 443
ultrascan_host_probe_update called for machine 82.96.64.4 state HOST_UP
-> HOST_UP (trynum 0 time: 169732)
Changing global ping host to 82.96.64.4.
Completed Ping Scan at 17:06, 0.17s elapsed (1 total hosts)
Overall sending rates: 11.77 packets / s.
mass_rdns: Using DNS server 207.86.143.242
mass_rdns: Using DNS server 206.205.242.132
Initiating Parallel DNS resolution of 1 host. at 17:06
mass_rdns: 0.53s 0/1 [#: 2, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 17:06, 0.52s elapsed
DNS resolution of 1 IPs took 0.53s. Mode: Async [#: 2, OK: 1, NX: 0, DR:
0, SF: 0, TR: 1, CN: 0]
Initiating Connect Scan at 17:06
Scanning irc.freenode.net (82.96.64.4) [3 ports]
Discovered open port 6667/tcp on 82.96.64.4
Discovered open port 7070/tcp on 82.96.64.4
Discovered open port 7000/tcp on 82.96.64.4
Changing global ping host to 82.96.64.4.
Completed Connect Scan at 17:06, 0.18s elapsed (3 total ports)
Overall sending rates: 17.03 packets / s.
Fetchfile found ./nmap-service-probes
Initiating Service scan at 17:06
Scanning 3 services on irc.freenode.net (82.96.64.4)
Starting probes against new service: 82.96.64.4:6667 (tcp)
NSOCK (2.2170s) TCP connection requested to 82.96.64.4:6667 (IOD #1) EID 8
Starting probes against new service: 82.96.64.4:7000 (tcp)
NSOCK (2.2170s) TCP connection requested to 82.96.64.4:7000 (IOD #2) EID 16
Starting probes against new service: 82.96.64.4:7070 (tcp)
NSOCK (2.2170s) TCP connection requested to 82.96.64.4:7070 (IOD #3) EID 24
NSOCK (2.3850s) Callback: CONNECT SUCCESS for EID 8 [82.96.64.4:6667]
Service scan sending probe NULL to 82.96.64.4:6667 (tcp)
NSOCK (2.3850s) Read request from IOD #1 [82.96.64.4:6667] (timeout:
6000ms) EID 34
NSOCK (2.3860s) Callback: CONNECT SUCCESS for EID 16 [82.96.64.4:7000]
Service scan sending probe NULL to 82.96.64.4:7000 (tcp)
NSOCK (2.3860s) Read request from IOD #2 [82.96.64.4:7000] (timeout:
6000ms) EID 42
NSOCK (2.3860s) Callback: CONNECT SUCCESS for EID 24 [82.96.64.4:7070]
Service scan sending probe NULL to 82.96.64.4:7070 (tcp)
NSOCK (2.3860s) Read request from IOD #3 [82.96.64.4:7070] (timeout:
6000ms) EID 50
NSOCK (2.5600s) Callback: READ SUCCESS for EID 34 [82.96.64.4:6667] (67
bytes): :kornbluth.freenode.net NOTICE * :*** Looking up your hostname.....
Service scan hard match (Probe NULL matched with NULL): 82.96.64.4:6667
is irc
NSOCK (8.3860s) Callback: READ TIMEOUT for EID 42 [82.96.64.4:7000]
Service scan sending probe RPCCheck to 82.96.64.4:7000 (tcp)
NSOCK (8.3860s) Write request for 44 bytes to IOD #2 EID 59
[82.96.64.4:7000]: ...(r..................|....................
NSOCK (8.3860s) Read request from IOD #2 [82.96.64.4:7000] (timeout:
5000ms) EID 66
NSOCK (8.3860s) Callback: READ TIMEOUT for EID 50 [82.96.64.4:7070]
Service scan sending probe GetRequest to 82.96.64.4:7070 (tcp)
NSOCK (8.3860s) Write request for 18 bytes to IOD #3 EID 75
[82.96.64.4:7070]: GET / HTTP/1.0....
NSOCK (8.3860s) Read request from IOD #3 [82.96.64.4:7070] (timeout:
5000ms) EID 82
NSOCK (8.3870s) Callback: WRITE SUCCESS for EID 59 [82.96.64.4:7000]
NSOCK (8.3870s) Callback: WRITE SUCCESS for EID 75 [82.96.64.4:7070]
NSOCK (8.5550s) Callback: READ ERROR [Connection reset by peer (54)] for
EID 82 [82.96.64.4:7070]
NSOCK (8.5550s) TCP connection requested to 82.96.64.4:7070 (IOD #4) EID 88
NSOCK (8.5570s) Callback: READ ERROR [Connection reset by peer (54)] for
EID 66 [82.96.64.4:7000]
NSOCK (8.5570s) TCP connection requested to 82.96.64.4:7000 (IOD #5) EID 96
NSOCK (8.7250s) Callback: CONNECT SUCCESS for EID 88 [82.96.64.4:7070]
Service scan sending probe RTSPRequest to 82.96.64.4:7070 (tcp)
NSOCK (8.7250s) Write request for 22 bytes to IOD #4 EID 107
[82.96.64.4:7070]: OPTIONS / RTSP/1.0....
NSOCK (8.7250s) Read request from IOD #4 [82.96.64.4:7070] (timeout:
5000ms) EID 114
NSOCK (8.7250s) Callback: WRITE SUCCESS for EID 107 [82.96.64.4:7070]
NSOCK (8.7260s) Callback: CONNECT SUCCESS for EID 96 [82.96.64.4:7000]
Service scan sending probe DNSVersionBindReq to 82.96.64.4:7000 (tcp)
NSOCK (8.7260s) Write request for 32 bytes to IOD #5 EID 123
[82.96.64.4:7000]: ...............version.bind.....
NSOCK (8.7260s) Read request from IOD #5 [82.96.64.4:7000] (timeout:
5000ms) EID 130
NSOCK (8.7260s) Callback: WRITE SUCCESS for EID 123 [82.96.64.4:7000]
NSOCK (8.8950s) Callback: READ SUCCESS for EID 114 [82.96.64.4:7070] (42
bytes): ERROR :Reconnecting too fast, throttled...
Service scan match (Probe RTSPRequest matched with NULL):
82.96.64.4:7070 is irc.  Version: |Unreal ircd|||
NSOCK (8.9030s) Callback: READ SUCCESS for EID 130 [82.96.64.4:7000] (42
bytes): ERROR :Reconnecting too fast, throttled...
Service scan match (Probe DNSVersionBindReq matched with NULL):
82.96.64.4:7000 is irc.  Version: |Unreal ircd|||
Completed Service scan at 17:06, 6.69s elapsed (3 services on 1 host)
Starting RPC scan against irc.freenode.net (82.96.64.4)
Fetchfile found ./nmap-rpc
NSE: Script scanning 82.96.64.4.
Nmap scan report for irc.freenode.net (82.96.64.4)
Host is up, received conn-refused (0.17s latency).
Other addresses for irc.freenode.net (not scanned): 86.65.39.15
128.237.157.136 130.239.18.172 140.211.166.3 140.211.166.4
193.107.206.21 208.71.169.36 213.92.8.4 213.161.196.11 213.179.58.83
213.232.93.3 216.155.130.130 216.165.191.52 38.229.70.20 78.40.125.4
rDNS record for 82.96.64.4: kornbluth.freenode.net
Scanned at 2010-11-10 17:06:44 PST for 8s
PORT     STATE SERVICE REASON  VERSION
6667/tcp open  irc     syn-ack
7000/tcp open  irc     syn-ack Unreal ircd
7070/tcp open  irc     syn-ack Unreal ircd
Final times for host: srtt: 171073 rttvar: 56592  to: 397441

Read from .: nmap-payloads nmap-rpc nmap-service-probes nmap-services.
Service detection performed. Please report any incorrect results at
http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.99 seconds


I would expect something like the following:

PORT     STATE SERVICE REASON  VERSION
6667/tcp open  irc     syn-ack
7000/tcp open  ssl/irc syn-ack Unreal ircd
7070/tcp open  ssl/irc syn-ack Unreal ircd


Am I doing something wrong?


-- 
Matt
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/