Nmap Fingerprint Databases: 7 Core Libraries, NSE Extensions & Version Evolution

Nmap (Network Mapper) is the most widely used open-source network scanning and security auditing tool in the world. Its core identification capabilities rely on seven built-in fingerprint databases that cover operating systems, service versions, protocols, ports, MAC vendors, RPC programs, and NSE script extensions. As of the latest release Nmap 7.99 (March 26, 2026), these databases have evolved into one of the most comprehensive and active fingerprint identification ecosystems in the cybersecurity field.

Understanding the structure and working principles of these fingerprint databases will not only help you use Nmap more effectively but also enable you to customize fingerprint rules when needed and even contribute new fingerprint data to the community.

Nmap Fingerprint Identification System Overview

Nmap’s fingerprint identification capabilities are built on seven core data files, all prefixed with nmap-. The table below summarizes the key metrics of these seven databases:

These seven databases work together to form Nmap’s complete fingerprint identification pipeline, from the network layer to the application layer. The following flowchart illustrates the core fingerprint identification process:

flowchart TD
    A["Send Probe<br/>Packets"] --> B["Collect<br/>Responses"]
    B --> C{"Match Against<br/>Fingerprint DBs"}
    C --> D["nmap-os-db<br/>OS Fingerprints"]
    C --> E["nmap-service-probes<br/>Service Signatures"]
    C --> F["nmap-services<br/>Port Mapping"]
    D --> G["Identification<br/>Result"]
    E --> G
    F --> G

    style A fill:#FF9800,color:#000
    style B fill:#2196F3,color:#fff
    style C fill:#9C27B0,color:#fff
    style D fill:#4CAF50,color:#fff
    style E fill:#4CAF50,color:#fff
    style F fill:#4CAF50,color:#fff
    style G fill:#2196F3,color:#fff

Nmap first sends carefully crafted probe packets to the target, collects response data, then matches against the OS fingerprint database, service signature database, and port mapping table sequentially, ultimately producing a comprehensive identification result. Each database handles a specific identification dimension, complementing one another.

OS Fingerprint Database: nmap-os-db

nmap-os-db is the core database for Nmap’s OS detection feature, used with the -O option for remote operating system identification. It contains thousands of fingerprint blocks, each recording how a different operating system responds to Nmap’s specialized probe packets.

How It Works

Nmap sends a series of specially crafted TCP/UDP/ICMP probe packets to the target, then compares the target’s responses against the fingerprints in nmap-os-db. The matching is based on the following key characteristics:

• TCP ISN Sequence (SEQ): Initial sequence number generation pattern (random increment, time-based, etc.)
• TCP Option Support (OPS): Different operating systems support significantly different sets of TCP options
• IP ID Sequence Generation (IPID): Incrementing, random, zero-value, and other patterns
• TCP Timestamp Handling (TS): Whether timestamps are supported and their precision
• Abnormal Flag Combination Response (ECN/T1-T7): Response behavior to abnormal TCP flag combinations
• ICMP Response Characteristics (U1/IE): Response differences to ICMP probes

Fingerprint Format Example

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

Fingerprint Linux 2.6.17 - 2.6.24
Class Linux | Linux | 2.6.X | general purpose
SEQ(SP=A5-D5%GCD=1-6%ISR=A7-D7%TI=Z%II=I%TS=U)
OPS(O1=M400C%O2=M400C%O3=M400C%O4=M400C%O5=M400C%O6=M400C)
WIN(W1=8018%W2=8018%W3=8018%W4=8018%W5=8018%W6=8018)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=8018%O=M400C%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=8018%S=O%A=S+%F=AS%O=M400C%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

Each fingerprint block begins with a Fingerprint line, followed by a Class line (OS classification) and a CPE line (Common Platform Enumeration identifier). The core test data includes SEQ (sequence analysis), OPS (TCP options), WIN (window size), ECN (Explicit Congestion Notification), T1-T7 (seven TCP probes), U1 (UDP probe), and IE (ICMP probe) test groups.

Service Version Detection Database: nmap-service-probes

nmap-service-probes is the core database for Nmap’s service and version detection, used with the -sV option. It contains a large number of custom probe requests and expected response matching rules that can identify the specific service program and version running on an open port.

How It Works

Nmap’s service version detection proceeds through multiple stages:

1. NULL Probe: First sends an empty probe packet to attempt banner grabbing
2. Port-Specific Probe: Sends protocol-specific probe packets based on the port number (e.g., HTTP requests to port 80)
3. Regex Matching: Compares returned data against regex matching rules in nmap-service-probes
4. Post-Processing: Applies RPC grinding, SSL tunnel detection, and other post-processing techniques
5. Output: Finally outputs service name, version number, additional information, and CPE identifier

Supported Protocol Types

nmap-service-probes supports over 1,246 protocols. Here are some representative ones:

afp bitcoin caldav dhcp dns ftp grpc http imap ipp ldap mongodb mqtt mysql mysqlx nfs ntp pop3 postgresql rdp redis remotemouse rpc rsync sip smb smtp snmp ssh ssl telnet tuya vnc xmpp xml-rpc yiff zebra essnet

Probe and Match Format

The nmap-service-probes file structure includes the following key directives:

• Exclude: Excludes specific ports to avoid unnecessary probing
• Probe: Defines probe requests, including protocol type, probe string, and probe name
• match: Defines matching rules using regular expressions to extract service name, version, and other information from responses
• softmatch: Soft matching rules that provide partial match information

Known Ports List: nmap-services

nmap-services is a registry of port numbers to service names, with each line containing the service name, port number/protocol, and port frequency value. The file was originally based on the IANA-assigned port list but has been augmented over the years with many additional ports, including those commonly used by trojans, worms, and other malware.

Example Content

1
2
3
4
5

ssh     22/tcp    0.182286    # Secure Shell Login
telnet  23/tcp    0.221265
smtp    25/tcp    0.131314    # Simple Mail Transfer
http    80/tcp    0.484143    # World Wide Web HTTP
https   443/tcp   0.323559    # Secure HTTP

The port frequency value reflects the probability of that port being open on the internet. Nmap scans the top 1,000 most frequent ports by default to balance scan speed and coverage.

Auxiliary Fingerprint Databases

In addition to the three core databases above, Nmap relies on four auxiliary fingerprint databases for specific identification scenarios.

SunRPC Program Number Mapping: nmap-rpc

nmap-rpc maps SunRPC program numbers to their corresponding program names, used exclusively for the RPC Grinding feature in Nmap’s version detection. The format is identical to the Unix system’s /etc/rpc file.

MAC Address Vendor Prefixes: nmap-mac-prefixes

nmap-mac-prefixes maps the OUI (first 3 bytes) of a MAC address to the device manufacturer name. When the target host is on a local Ethernet network, Nmap can read the MAC address from the packet header and query this table to roughly identify the device type.

Example content:

1
2
3
4

006017 Tokimec
006018 Stellar ONE
00601D Lucent Technologies
00601E Softlab

IP Protocol Number List: nmap-protocols

nmap-protocols maps the 1-byte protocol number in the IP header to the protocol name, used for IP protocol scanning (-sO). This file defines fewer than 140 protocols, with data sourced from IANA.

NSE Scripting Engine and Script Database

The Nmap Scripting Engine (NSE) is one of Nmap’s most powerful extensibility features, with over 600 Lua scripts organized into 14 functional categories. These scripts effectively form Nmap’s “advanced fingerprinting” capability, covering vulnerability detection, brute-forcing, service enumeration, information gathering, and more.

Complete NSE Script Category List

Representative Fingerprint-Related Scripts

New ICS Scripts in 7.95

Nmap 7.95 introduced 4 new NSE scripts from the DINA community, specifically designed for querying industrial control systems:

Fingerprint Database Version Evolution

Nmap’s fingerprint databases evolve continuously, with each major release incorporating substantial amounts of new fingerprint data. The following table summarizes recent major version updates:

File Paths and Customization

Default Installation Paths

Custom Data Files

Advanced users can use custom data files with the following options:

• --datadir <directory>: Specify a custom data file directory
• --servicedb <file>: Specify a custom nmap-services file
• --versiondb <file>: Specify a custom nmap-service-probes file

Note: It is strongly recommended to upgrade to the latest Nmap version rather than replacing data files individually. Mixing old and new versions can lead to confusion in the fingerprint submission process and compatibility is not guaranteed.

Submitting Fingerprint Contributions

When Nmap cannot identify an operating system or service, it automatically generates a fingerprint and displays a submission URL. Users can contribute in the following ways:

• OS Fingerprints: Submit following the Nmap official documentation guidelines
• Service Fingerprints: Refer to the service detection community contribution guide
• Submission Email: [email protected]

The greatest strength of Nmap’s fingerprint databases lies in their active community contribution mechanism — every unrecognized fingerprint can be fed back to the development team through Nmap’s built-in submission functionality, enabling the database to continuously cover the latest operating systems, devices, and services. Nmap 7.95 integrated over 6,500 community-submitted fingerprints in a single release, fully demonstrating the vitality of this ecosystem.

Summary

Nmap’s seven fingerprint databases form a layered, collaborative identification system. From the low-level OS fingerprint database (nmap-os-db) to the application-layer service version detection (nmap-service-probes), from port mapping (nmap-services) to MAC vendor identification (nmap-mac-prefixes), and further to RPC program numbers (nmap-rpc), IP protocol numbers (nmap-protocols), and NSE script extensions — each database plays an irreplaceable role in Nmap’s identification pipeline.

Understanding the structure and working principles of these databases not only helps you use Nmap more effectively for network scanning and security auditing but also enables you to customize fingerprint rules when needed and contribute new fingerprint data to the community. As network technology continues to evolve, Nmap’s fingerprint databases keep pace, making it essential for every cybersecurity professional to stay informed about these databases.