nmap -sV: detect service versions on open ports

nmap -sV HOST adds version detection to a port scan: for every open port, Nmap connects, sends probes from its nmap-service-probes database and matches the replies, so the SERVICE column shows what actually runs there and the VERSION column the product and version (for example OpenSSH 9.6p1 Ubuntu 3ubuntu13 or nginx 1.24.0). Without -sV, the service name is only a guess from the port number. --version-intensity 0-9 trades speed for thoroughness (default 7).

Examples

nmap -sV 192.0.2.10                          # top 1000 ports, with versions
nmap -sV -p 22,80,443,5432 192.0.2.10        # only these ports (faster)
nmap -sV --version-light 192.0.2.10          # intensity 2: quicker, fewer probes
nmap -sV --version-all -p 8443 192.0.2.10    # intensity 9: try every probe
nmap -sV --version-trace -p 80 192.0.2.10    # show the probe exchange (debugging)
sudo nmap -sS -sV -O 192.0.2.10              # SYN scan, versions and OS detection (root)
nmap -A 192.0.2.10                           # -sV plus OS detection, default scripts and traceroute

Reading the output

The VERSION column comes from matched fingerprints. Extra details appear in brackets or in Service Info: lines (OS, device type). When a reply matches nothing, Nmap prints a SF: fingerprint block and asks you to submit it; the service then shows with a ? (for example http?), meaning the name is a guess.

Options

Version detection opens real connections and sends application data, so it is noisier than a plain port scan and shows up in service logs.