Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to check which server OS a particular site is running. For example from linux command line. Maybe via telnet? But all I can get from "telnet http" is:

Connected to
Escape character is '^]'.

Can somebody dwell on the subject if possible at all?

share|improve this question
up vote 11 down vote accepted

You can look for OS fingerprinting functionality built into NMap.

However, if you're looking for something like "What is Google running?" you won't get far since you won't know what's behind their load balancers, or firewalls will block it, and fingerprinting can only be so accurate so you can get false reports back and you may not get anywhere when the connection is somehow NAT'ed.

share|improve this answer
thank you. I've searched apt repos for nmap, and found xprobe app, that is designed exclusively for that purpose. – ervv Mar 27 '12 at 13:02

Many sites will tell you in the HTTP headers:

$ curl -s -I | grep Server
Server: Microsoft-IIS/7.5

$ curl -s -I | grep Server
Server: nginx/0.8.54

Some include the OS and sometimes version:

$ curl -s -I | grep Server
Server: Apache/2.2.9 (Unix)

$ curl -s -I | grep Server
Server: Apache/2.2.3 (Red Hat)

$ curl -s -I | grep Server
Server: Apache/2.2.3 (CentOS)

$ curl -s -I | grep Server
Server: Apache/2.2.21 (Unix) mod_ssl/2.2.21 OpenSSL/0.9.8r DAV/2 PHP/5.3.8

Some write their own web serving software:

$ curl -s -I | grep Server
Server: gws

$ curl -s -I | grep Server
Server: YTS/1.20.10

But some don't send the Server header:

$ curl -s -I 
HTTP/1.1 200 OK
Cache-Control: public, max-age=41
Content-Length: 129706
Content-Type: text/html; charset=utf-8
Expires: Tue, 27 Mar 2012 13:01:46 GMT
Last-Modified: Tue, 27 Mar 2012 13:00:46 GMT
Vary: *
Date: Tue, 27 Mar 2012 13:01:04 GMT

$ curl -s -I 
HTTP/1.1 302 Found
P3P: CP="Facebook does not have a P3P policy. Learn why here:"
Set-Cookie: datr=sbpxT_PpXR9FO5mMTy8pCTjD; expires=Thu, 27-Mar-2014 13:03:45 GMT; path=/;; httponly
Content-Type: text/html; charset=utf-8
X-FB-Debug: VJycxKwQ9bAV0Z/n6jfN1WSFx4pqj2337c1jc+pPlE0=
X-Cnection: close
Content-Length: 0
Date: Tue, 27 Mar 2012 13:03:45 GMT

Any or all of these could be lying. Bart's suggestion of nmap is more likely to be accurate but cannot produce 100% accurate results for the reasons he mentioned. It doesn't even make sense sometimes, for instance with the number of servers that are involved in fulfilling a single HTTP request at Google, their web servers, search servers, database servers, caching servers and whatever else they run could all potentially be using different operating systems and you would have no way of knowing.

share|improve this answer

Ask Netcraft: What's that site running? returns "server: gws" (ie Google Web Server).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.