Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to check which server OS a particular site is running. For example from linux command line. Maybe via telnet? But all I can get from "telnet www.google.com http" is:

Trying 209.85.173.104...
Connected to www.l.google.com.
Escape character is '^]'.

Can somebody dwell on the subject if possible at all?

share|improve this question

3 Answers 3

up vote 8 down vote accepted

You can look for OS fingerprinting functionality built into NMap.

However, if you're looking for something like "What is Google running?" you won't get far since you won't know what's behind their load balancers, or firewalls will block it, and fingerprinting can only be so accurate so you can get false reports back and you may not get anywhere when the connection is somehow NAT'ed.

share|improve this answer
2  
thank you. I've searched apt repos for nmap, and found xprobe app, that is designed exclusively for that purpose. –  ervv Mar 27 '12 at 13:02

Many sites will tell you in the HTTP headers:

$ curl -s -I hotmail.com | grep Server
Server: Microsoft-IIS/7.5

$ curl -s -I pinterest.com | grep Server
Server: nginx/0.8.54

Some include the OS and sometimes version:

$ curl -s -I linuxquestions.com | grep Server
Server: Apache/2.2.9 (Unix)

$ curl -s -I red.com | grep Server
Server: Apache/2.2.3 (Red Hat)

$ curl -s -I slashdot.org | grep Server
Server: Apache/2.2.3 (CentOS)

$ curl -s -I bar.com | grep Server
Server: Apache/2.2.21 (Unix) mod_ssl/2.2.21 OpenSSL/0.9.8r DAV/2 PHP/5.3.8

Some write their own web serving software:

$ curl -s -I google.com | grep Server
Server: gws

$ curl -s -I yahoo.com | grep Server
Server: YTS/1.20.10

But some don't send the Server header:

$ curl -s -I serverfault.com 
HTTP/1.1 200 OK
Cache-Control: public, max-age=41
Content-Length: 129706
Content-Type: text/html; charset=utf-8
Expires: Tue, 27 Mar 2012 13:01:46 GMT
Last-Modified: Tue, 27 Mar 2012 13:00:46 GMT
Vary: *
Date: Tue, 27 Mar 2012 13:01:04 GMT


$ curl -s -I www.facebook.com 
HTTP/1.1 302 Found
Location: http://www.facebook.com/common/browser.php
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Set-Cookie: datr=sbpxT_PpXR9FO5mMTy8pCTjD; expires=Thu, 27-Mar-2014 13:03:45 GMT; path=/; domain=.facebook.com; httponly
Content-Type: text/html; charset=utf-8
X-FB-Debug: VJycxKwQ9bAV0Z/n6jfN1WSFx4pqj2337c1jc+pPlE0=
X-Cnection: close
Content-Length: 0
Date: Tue, 27 Mar 2012 13:03:45 GMT

Any or all of these could be lying. Bart's suggestion of nmap is more likely to be accurate but cannot produce 100% accurate results for the reasons he mentioned. It doesn't even make sense sometimes, for instance with the number of servers that are involved in fulfilling a single HTTP request at Google, their web servers, search servers, database servers, caching servers and whatever else they run could all potentially be using different operating systems and you would have no way of knowing.

share|improve this answer

Ask Netcraft: What's that site running?

http://uptime.netcraft.com/up/graph?site=google.com returns "server: gws" (ie Google Web Server).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.