Changed port service from http to http-proxy

I have Apache running on 192.168.0.201 and listening to Port 80. namp shows me that Port 80/TCP is open and service is http.

[root@desktop ~]# nmap -p 80 -sT 192.168.0.201
Starting Nmap 5.51 ( ) at 2013-07-16 00:54 PDT
Nmap scan report for 192.168.0.201
Host is up (0.00083s latency).
PORT STATE SERVICE
80/tcp open http
MAC Address: 00:5C:53:4E:4B:00 (Dell)
Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds

I then changed Apache to listen to Port 8080 instead of Port 80. namp now shows me that Port 80/TCP is closed and service remains http. namp also now shows me that Port 8080/TCP is open and service is http-proxy.

What is the significance of http-proxy? Why did it change when I only changed the listen to port?

[root@desktop ~]# nmap -p 80 -sT 192.168.0.201
Starting Nmap 5.51 ( ) at 2013-07-16 00:57 PDT
Nmap scan report for 192.168.0.201
Host is up (0.00067s latency).
PORT STATE SERVICE
80/tcp closed http
MAC Address: 00:5C:53:4E:4B:00 (Dell)
Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds
[root@desktop ~]# nmap -p 8080 -sT 192.168.0.201
Starting Nmap 5.51 ( ) at 2013-07-16 00:57 PDT
Nmap scan report for 192.168.0.201
Host is up (0.00072s latency).
PORT STATE SERVICE
8080/tcp open http-proxy
MAC Address: 00:5C:53:4E:4B:00 (Dell)
Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds
[root@desktop ~]#

1 Answer

By default, nmap does not actually check what service is running. It just searches its services file for the matching port/protocol, e.g. 80/tcp. (Most programs use /etc/services for this, while nmap has its own "extended edition".) It so happens that IANA has assigned port 80 for running regular HTTP servers, and 8080 for proxies, so that's what nmap reports.

If you want to actually check the running services, use -sV, but beware that it's much slower and very visible in the server's logs.