Is "detect protocol only one direction" expected for postgres? (nmap -sV weirdness)

Developers
1

is “detect protocol only one direction” expected for postgres? (nmap -sV weirdness)

Hey everyone (or @Juliana if you’re the postgres parser developer, save me) —

So I’m doing this home-lab thing where I run nmap -sV scans at different speeds against Suricata, and every single time — like clockwork — I get the exact same alert: SID 1:2260002:1, always sitting on port 5432/postgres. Shivani told me different parsers can act differently even though the TCP handshake stuff underneath is the same, and that there could just be gaps specific to one parser’s things. That sounds like exactly what’s happening here but not gonna lie I don’t know enough yet to say for sure lol :slight_smile:

So — is this just expected/normal behavior for postgres (kinda like it already is for FTP/SMTP), or is it an actual gap in the parser? Genuinely just trying to understand what’s going on before I write about it instead of making stuff up :slight_smile:

Thanks so much, y’all are awesome for helping a random 10th grader figure this out :slight_smile:

— Manan