Windows编程

开发平台：

Java

nmap-service-probes：源码内容

match rpacd m|^x01n=The host is not in the allowed host list. Connection refused.$| p/WinPcap Remote Capture Packet daemon/ o/Windows/
match rpd m|^+host=cashew version=([d.]+) uptime=[d+:]+ audio-bits=d+ audio-byte-order=w+-endian| p/Remote Play Daemon/ v/$1/ o/Linux/
# Simple Asynchronous File Transfer (SAFT)
match saft m|^220 ([w-.]+) SAFT server (sendfiled ([w.]+) on ([w]+)) ready.rn| p/sendfiled/ v/$2/ h/$1/ o/$3/
match scanager m|^*** ITSO_DB_FAIL *** invalid requestrn| p/Indiana University Scanager DB/
match sdmsvc m|^[xaaxff]$| p/LANDesk Software Distribution/ i/sdmsvc.exe/ o/Windows/
# http://www.ietf.org/internet-drafts/draft-martin-managesieve-04.txt
match sieve m|^NO Fatal error: Error initializing actionsrn$| p|Cyrus timsieved| i|included w/cyrus imap|
match sieve m|^"IMPLEMENTATION" "Cyrus timsieved v([d.]+)-Red Hat [d.-]+"rn| p|Cyrus timsieved| v/$1/ i|Red Hat; included w/cyrus imap| o/Linux/
match sieve m|^"IMPLEMENTATION" "Cyrus timsieved v(d[-.w]+)"rn| p|Cyrus timsieved| v/$1/ i|included w/cyrus imap|
match sftp m|^+Shiva SFTP Service$| p/Shiva LanRover SFTP service/
match sgms m|^SGMS Scheduler SGMS (d+) ([d.]+) .*n>| p/Sonicwall Viewpoint SGMSd/ v/$2/ i/SGMS protocol $1/ d/firewall/
# HP-UX B.11.00 A 9000/785
match shell m|^x01remshd: getservbynamen$| p/HP-UX Remshd/ o/HP-UX/
# Backdoor shell!
match shell m|^(ba)?sh-d.dd# $| p/ROOT SHELL/
# good SMTP banner regexps can be found here:
# http://www.tty1.net/smtp-survey/measurement_en.html
match smtp m|^220 ([-/.+w]+) MailGate ready for ESMTP on | p/MailGate smtpd/ h/$1/ o/Windows/
match smtp m|^220 ([-/.+w]+) SMTP ready to rollrn| p/Hotmail Popper hotmail to smtp gateway/ h/$1/
match smtp m|^220 ([-/.+w]+) AvMailGate-(d[-.w]+)rn| p/AvMailGate smtp anti-virus mail gateway/ h/$1/ v/$2/
match smtp m|^220 ([-/.+w]+) Internet Rex ESMTP daemon at your service.rn| p/Internet Rex smtpd/ h/$1/
match smtp m|^220 ([-.+w]+) ESMTP NetIQ MailMarshal (v(d[-.w]+)) Readyrn| p/MailMarshal/ h/$1/ v/$2/
match smtp m|^220 ([-.+w]+) ESMTP NetIQ MailMarshal d[-.w]+ Service Pack (w+) (v(d[-.w]+)) Readyrn| p/MailMarshal/ h/$1/ v/$3 Service Pack $2/
# I think the revision number is different than the official product version number
# Dots in Revision to prevent MY CVS from screwing it up
match smtp m|^220 ([-.+w]+) Novonyx SMTP ready $Re..sion: *([d.]+) *$rn| p|Novonyx Novell NetMail smtpd| h|$1| v|$2|
match smtp m|^554-([-.+w]+).usrn554 Access deniedrn$| p/IronPort appliance mail rejector/ h/$1/
match smtp m|^220 eSafe@([-.+w]+) Service readyrn| p/eSafe mail gateway/ h/$1/
match smtp m|^220 (S+) ESMTP Merak (d[^;]+);| p/Merak Mail Server smtpd/ h/$1/ v/$2/ o/Windows/
match smtp m|^220 ]-:^:-[ ESMTP ]-:^:-[; .*rn| p/Merak Mail Server smtpd/ o/Windows/
match smtp m|^220.*?MERCUR SMTP[s-]Server (v([^)]+)) for ([-.w ]+) ready at | p/LAN-ACES MERCUR smtp server/ v/$1/ o/$2/
match smtp m|^220 ([-.+w]+) MasqMail (d[-.w]+) ESMTPrn| p/MasqMail smtpd/ h/$1/ v/$2/
# Cisco NetWorks ESMTP server IOS (tm) 5300 Software (C5300-IS-M) on Cisco 5300 Access Server
match smtp m|^220 ([-.+w]+) Cisco NetWorks ESMTP serverrn| p/Cisco IOS NetWorks smtp server/ h/$1/ d/terminal server/ o/IOS/
match smtp m|^220 ([-.+w]+) Mercury/32 v(d[-.w]+) ESMTP server ready.rn| p|Mercury/32 smtpd| h|$1| v|$2| o|Windows|
# Canon ImageRunner SMTP server (network scanner/copier/printer)
match smtp m|^220 Canon[-.w]+ ESMTP Readyrn| p/Canon printer smtp server/ d/printer/
match smtp m|^220 .*?eSafe E?SMTP Service (dS+) ready| p/eSafe mail gateway/ v/$1/
match smtp m|^220 .*?eSafe E?SMTP Service ready| p/eSafe mail gateway/
match smtp m|^520 Connection not authorised from this address.rn| p|Mercury smtpd| i|Connection not authorised|
# Exim 3.36 on Linux 2.4 blocking the given IP
match smtp m|^554 SMTP service not availablern$| p/Exim smtpd/ i/Serviced refused (IP block)/
# Jana Server 1.45 on Win98
match smtp m|^220 Jana-Server Simple Mail Transfer Service readyrn| p/Jana mail server/ o/Windows/
match smtp m|^220 <1d+.d+@([-.w]+)> [XMail (d[-.w]+) ESMTP Server] service ready; | p/XMail SMTP server/ h/$1/ v/$2/
match smtp m|^220 <1d+.d+@([-.w]+)> [XMail (d[-.w]+) (([-./w]+)) ESMTP Server] service ready; | p/XMail SMTP server/ h/$1/ v/$2/ i/on $3/
match smtp m|^220 ([-.w]+) FirstClass ESMTP Mail Server v(d[-.w]+) readyrn| p/FirstClass SMTP server/ h/$1/ v/$2/
match smtp m|^220 ([-.w]+) AppleMailServer (d[-.w]+) SMTP Server Readyrn| p/AppleMailServer/ h/$1/ v/$2/
match smtp m|^220 ([-.w]+) ESMTP CommuniGate Pro (d[-.w]+)rn| p/Communigate Pro SMTP/ h/$1/ v/$2/
match smtp m|^220[- ]([-.w]+) MailSite ESMTP Receiver Version (d[-.w]+) Readyrn| p/Rockliffe MailSite/ h/$1/ v/$2/
match smtp m|^220 ([-.w]+) eXtremail V(d[-.w]+) release (d+) ESMTP server ready ...rn| p/eXtremail smtpd/ h/$1/ v/$2.$3/
match smtp m|^220 ([-.w]+) eXtremail V(d[-.w]+) release (d+) rev(d+) ESMTP server ready ...rn| p/eXtremail smtpd/ h/$1/ v/$2.$3.$4/
match smtp m|^220 Welcome to ([-.w]+) - VisNetic MailScan ESMTP Server BUILD (d[-.w]+)rn| p/VisNetic MailScan ESMTP server/ h/$1/ v/$2/
# HP Service Desk 4.5 SMTP Server
match smtp m|^220 ([-.w]+) service desk (d[-.w]+) SMTP Service Ready for input.rn| p/HP Service Desk SMTP server/ h/$1/ v/$2/
# VPOP3 SMTP server 2.0.0d
match smtp m|^220 ([-.w]+) VPOP3 SMTP Server Readyrn| p/PSCS VPOP3 mail server/ h/$1/
# CommuniGate Pro 4.1.3 on Mac OS X 10.2.6
match smtp m|^220 ([-.w]+) ESMTP CommuniGate Pro (d[-.w]+) is glad to see you!rn| p/CommuniGate Pro mail server/ h/$1/ v/$2/
match smtp m|^220[ -]([-.w]+) ESMTP MDaemon (d[-.w]+); | p/Alt-N MDaemon mail server/ h/$1/ v/$2/ o/Windows/
match smtp m/^220 ([-.+w]+) (IMail ([^)]+)) NT-ESMTP Server/ p/IMail NT-ESMTP/ h/$1/ v/$2/ o/Windows/
match smtp m/^220 X1 NT-ESMTP Server ([-.+w]+) (IMail ([^)]+))rn/ p/IMail NT-ESMTP/ h/$1/ v/$2/ o/Windows/
match smtp m|^421 Insufficient System Storage.(IMail ([d.]+))rn| p/IMail smtpd/ v/$1/ i/Storage full/ o/Windows/
match smtp m/^220-([-.+w]+) Microsoft SMTP MAIL ready at.*Version: ([-w.]+)rn/ p/Microsoft SMTP/ h/$1/ v/$2/ o/Windows/
match smtp m/^220 ([-.+w]+) Microsoft ESMTP MAIL Service, Version: ([-w.]+) ready/ p/Microsoft ESMTP/ h/$1/ v/$2/ o/Windows/
match smtp m/^220 ([-.+w]+) ESMTP Server (Microsoft Exchange Internet Mail Service ([-w.]+)) ready/ p/Microsoft Exchange/ h/$1/ v/$2/ o/Windows/
match smtp m|^220 +OK Microsoft Exchange SMTP server version ([d.]+)rn| p/Microsoft Exchange/ v/$1/ o/Windows/
match smtp m|^220[s-](S+) E?SMTP Sendmail (d[^; ]+)| p/Sendmail/ h/$1/ v/$2/ o/Unix/
match smtp m|^220[s-](S+) E?SMTP Sendmail AIX([d.]+)/(d[^; ]+)| p/Sendmail/ h/$1/ v/$3/ i/AIX $2/ o/AIX/
match smtp m|^220[s-](S+) Sendmail (SMI-S+) ready at .*rn$| p/Sendmail/ h/$1/ v/$2/ o/Unix/
match smtp m|^220[s-]([w-_.]+) Sendmail (S+) ready at .*rn| p/Sendmail/ h/$1/ v/$2/ o/Unix/
match smtp m/^220[- ]([^rn]+) ESMTP Exim (V?dS+)/ p/Exim smtpd/ h/$1/ v/$2/
match smtp m/^220[- ].*rn220[- ]([^rn]+) ESMTP Exim /s p/Exim smtpd/ h/$1/
match smtp m/^220 CheckPoint FireWall-1 secure ESMTP serverrn$/ p/Checkpoint FireWall-1 smtpd/ d/firewall/
match smtp m/^220 CheckPoint FireWall-1 secure SMTP serverrn$/ p/Checkpoint FireWall-1 smtpd/ d/firewall/
match smtp m|^220 ([-.+w]+) running IBM AS/400 SMTP V([w]+)| p|IBM AS/400 smtpd| h|$1| v|$2|
match smtp m|^220 ([-.+w]+) ESMTP MailEnable Service, Version: (d[.-w]+)- ready at | p/MailEnable smptd/ h/$1/ v/$2/
match smtp m/^220 ([-.+w]+) ESMTP Mail Enable SMTP Service, Version: (d[w.]+)-- ready at/ p/MailEnable smptd/ h/$1/ v/$2/
match smtp m|^220 ([-.+w]+) ESMTP MailEnable Service, Version: d+--([d.]+) ready at| p/MailEnable smptd/ h/$1/ v/$2/
match smtp m/^220 ([-.+w]+) ESMTP CPMTA-([-.+w]+) - NO UCErn/ p/CPMTA/ h/$1/ v/$2/ i/qmail-derived/
match smtp m|^220 ([-.+w]+) SMTP/smap Ready.rn| p/Smap/ i/from firewall toolkit/ h/$1/
match smtp m|^220 ([-.+w]+) ESMTP service (Netscape Messaging Server ([-.+ w]+) (built| p/Netscape Messaging Server/ h/$1/ v/$2/
match smtp m|^220-InterScan Version (S+) .*Readyrn220 ([-.+w]+) NTMail (v([-.+w]+)/.* ready| p/Trend Micro InterScan/ h/$2/ v/$1/ i/on NTMail $3/ o/Windows/
match smtp m|^220-InterScan Version (S+) .*Readyrn220 ([-.+w]+) ESMTP Postfixrn| p/Trend Micro InterScan/ h/$2/ v/$1/ i/on Postfix/ o/Unix/
match smtp m|^220-InterScan Version (S+) .*Readyrn220 ([-.+w]+) Microsoft ESMTP MAIL Service, Version: ([d.]+) ready at| p/Trend Micro InterScan/ h/$2/ v/$1/ i/on Microsoft ESMTP $3/ o/Windows/
match smtp m|^220-InterScan Version (S+) .*Readyrn| p/Trend Micro InterScan/ v/$1/
match smtp m|^220 ([-.w]+) InterScan VirusWall NT ESMTP (d[-.w]+) (build (d+)) ready at | p/Trend Micro InterScan VirusWall SMTP/ h/$1/ v/$2 build $3/ o/Windows/
match smtp m|^220 ([-.+w]+) GroupWise Internet Agent (S+) .*Novell, Inc..*rn| p/Novell GroupWise/ h/$1/ v/$2/
match smtp m|^220 S+ S+ ESMTP receiver fssmtpd(d+) ready| p/fssmtpd/ v/$1/
match smtp m/Failed to open configuration file.*exim/ p/Exim smtpd/ i/broken/
match smtp m/^220 Trend Micro ESMTP ([-.+w]+) ready.rn$/ p/Trend Micro ESMTP/ v/$1/
match smtp m|^220 Matrix SMTP Mail Server v([w.]+) on <MATRIX_([w]+)> Simple Mail Transfer Service Readyrn| p/Matrix SMTP Mail Server/ v/$1/ i/on Matrix $2/
match smtp m|^220(S+) WebShield SMTP V(dS.*?) Network Associates, Inc. Ready at| p/Network Associates WebShield/ h/$1/ v/$2/
match smtp m|^220(S+) WebShielde(w+)/SMTP Ready.| p/WebShielde$2 smtpd/ h/$1/
match smtp m|^220 ([-.+w]+) ESMTP MailMasher ready to boogiern| p/MailMasher smtpd/ h/$1/
# 220 example.com ESMTP Postfix (2.0.13) (Mandrake Linux)
match smtp m|^220 ([-.w]+) ESMTP Postfix (([-.w]+)) (([-.w ]+))| p/Postfix smtpd/ h/$1/ v/$2/ i/$3/
# postfix 1.1.11-0.woody2
match smtp m|^220([s-]S+) ESMTP Postfix| p/Postfix smtpd/ h/$1/
match smtp m|^220 [*d ]{10,300}rn| p|Cisco PIX sanatized smtpd| d|firewall|
match smtp m|^220 ArGoSoft Mail Server Pro for WinNT/2000/XP, Version ([-.w]+) (([-.w]+))rn| p/ArGoSoft Mail Server Pro/ v/$1/ i/$2/ o/Windows/
match smtp m|^220 ([w-.]+) ArGoSoft Mail Server Pro for WinNT/2000/XP, Version [d.]+ (([d.]+))rn| p/ArGoSoft Mail Server Pro/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 ([w-.]+) ArGoSoft Mail Server, Version [d.]+ (([d.]+))rn| p/ArGoSoft Mail Server/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) ArGoSoft Mail Server Freeware, Version [d.]+ (([d.]+))rn| p/ArGoSoft Mail Server Freeware/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 ArGoSoft Mail Server Plus for WinNT/2000, Version [d.]+ (([d.]+))rn| p/ArGoSoft Mail Server Plus/ v/$1/ o/Windows/
match smtp m|^220 ([-.w]+) ESMTP server (Post.Office v([-.w]+) release ([-.w]+) ID# | p/Post.Office/ h/$1/ v/$2 release $3/
match smtp m|^220 ([-.w]+) ESMTP VisNetic.MailServer.v([-.w]+); | p/VisNetic MailServer/ h/$1/ v/$2/
# CommuniGate Pro 4.0.5
match smtp m|^220 ([-.w]+) ESMTP Service. Welcome.rn$| p/CommuniGate Pro smtpd/ h/$1/
match smtp m|^220 ([-.w]+) Process Software ESMTP service V([-.w]+) ready| p/Process Software smtpd/ h/$1/ v/$2/ o/OpenVMS/
match smtp m|^220 ([-.w]+) Mercury (d[-.w]+) ESMTP server ready.rn$| p/Mercury Mail smtpd/ h/$1/ v/$2/
match smtp m|^220 ([-.w]+) ESMTP Service (Lotus Domino Release (d[-.w]+)) ready at | p/Lotus Domino smtpd/ h/$1/ v/$2/
match smtp m|^220 ESMTP Service (Lotus Domino Release (d[-.w]+)) ready at | p/Lotus Domino smtpd/ v/$1/
match smtp m|^220 ([-.w]+) ESMTP Service (Lotus Domino Build V([w_]+) Beta (w+)) ready at | p/Lotus Domino smtpd/ h/$1/ v/$2 Beta $3/
match smtp m|^220 ESMTP Service (Lotus Domino Build V([w_]+) Beta (w+)) ready at | p/Lotus Domino smtpd/ v/$1 Beta $2/
match smtp m|^220 ([-.w]+) WebSTAR Mail Simple Mail Transfer Service Readyrn| p/WebSTAR SMTP server/ h/$1/
match smtp m|^220 ([-.w]+) Lotus SMTP MTA Service Readyrn$| p/Lotus Notes SMTP/ h/$1/
match smtp m|^220 ([-.w]+) SMTP NAVGW (d[-.w]+);| p/Norton Antivirus Gateway NAVGW/ h/$1/ v/$2/
match smtp m|^220 ([-.w]+) Kerio MailServer (d[-.w]+) ESMTP readyrn$| p/Kerio MailServer/ h/$1/ v/$2/
match smtp m|^220 YSmtp(S+) ESMTP service ready| p/Yahoo! smtpd/ h/$1/
match smtp m|^220 (S+) GMX Mailservices ESMTP| p/GMX smtpd/ h/$1/
match smtp m|^220 (S+) ESMTP MailMax (d[-.wd]+)| p/MailMax smtpd/ h/$1/ v/$2/
match smtp m|^220 (S+) ESMTP WEB.DE V([^s;]+)| p/Web.de smtpd/ h/$1/ v/$2/
match smtp m|^relaylock: Error: PRODUCT_ROOT_D not definednrelaylock: Error: PRODUCT_ROOT_D not definedn1n$| p/Plesk relaylock smtp wrapper/ i/broken/
match smtp m|^220 Compuserve Office Mail Service (lnxc-(d+)) ESMTP| p/Compuserve smtpd/ v/$1/
match smtp m|^220 Welcome to Nemesis ESMTP server on S+| p/Nemesis smtpd/
match smtp m|^220 Welcome to the INDY SMTP Serverrn$| p/INDY smtpd/
match smtp m|^220 Postini E?SMTP (d+) [wd_+-]+ ready| p/Postini smtpd/ v/$1/
match smtp m|^220 ([wd-]+).hotmail.com Sending unsolicited commercial| p/Hotmail smtpd/ h/$1/
match smtp m|^220[-s](S+) (IntraStore TurboSendmail) E?SMTP Service ready| p/TurboSendmail smtpd/ h/$1/
match smtp m|^220[-s](S+) E?SMTP Mirapoint (d[^;]+);| p/Mirapoint smtpd/ h/$1/ v/$2/
match smtp m|^220[-s](S+) Trend Micro InterScan Messaging Security Suite, Version: (dS+) ready| p/Trend Micro InterScan smtpd/ h/$1/ v/$2/
match smtp m|^220[-s](S+).*?Server ESMTP (iPlanet Messaging Server (d[^()]+)| p/Sun iPlanet smtpd/ h/$1/ v/$2/
match smtp m|^220[-s](S+) running Eudora Internet Mail Server (dS+)| p/Eudora smtpd/ h/$1/ v/$2/ o/Windows/
match smtp m|^220[-s](S+) running Eudora Internet Mail Server X (dS+)rn| p/Eudora smtpd/ h/$1/ v/$2/ o/Mac OS X/
match smtp m|^220 (S+) - Maillennium E?SMTP| p/Maillennium smtpd/ h/$1/
match smtp m|^220 (S+).*?SMTP (Sun Internet Mail Server sims.(d[^)]+))| p/Sun sims smtpd/ h/$1/ v/$2/
match smtp m|^220 (S+) ESMTP qpsmtpd (dS+) ready;| p/qpsmtpd/ h/$1/ v/$2/
match smtp m|^220 (S+) ESMTP XWall v(dS+)| p/XWall smtpd/ h/$1/ v/$2/
match smtp m|^220 (S+) ESMTP Service (Worldmail (d[^)]+)) ready| p/Worldmail smtpd/ h/$1/ v/$2/ o/Windows/
match smtp m|^220 (S+) eMail Sentinel (d+) ESMTP Service ready| p/eMail Sentinel smtpd/ v/$1/
match smtp m|^220 (S+) ESMTP mxl_mta-(d[^;]+);| p/mxl smtpd/ h/$1/ v/$2/
match smtp m|^220 (S+) -- Server ESMTP (SUN JES MTA 6.x)| p/SUN JES smtpd/ h/$1/ v/6.x/
match smtp m|^220 (S+) Service ready by DvISE PostMan ((d+)) ESMTP Server| p/DvISE PostMan smtpd/ h/$1/ v/$2/
match smtp m|^220 ([w-_.]+) Service ready by DvISE PostMan ((d+)) ESMTP Server (Tobit Software, Germany)rn| p/DvISE PostMan smtpd/ h/$1/ v/$2/
match smtp m|^220 (S+) F-Secure Anti-Virus for Internet Mail ready| p/F-Secure AV SMTP Proxy/ h/$1/
match smtp m|^220 (S+) Welcome to SpamFilter for ISP SMTP Server v(dS+)| p/LogSat SMTP Proxy/ h/$1/ v/$2/
match smtp m|^220-TrendMicro IMSS SMTP proxyrn| p/TrendMicro SMTP Proxy/
match smtp m|^220 ?(S+) ESMTP server (InterMail v(S+)| p/InterMail smtpd/ h/$1/ v/$2/
match smtp m|^220 ([w-_.]+) -- Server ESMTP (Sun Java System Messaging Server ([d.]+) (built .*))rn| p/SUN JSMS smtpd/ v/$2/ h/$1/
match smtp m|^220 (S+) -- Server ESMTP (Sun Java System Messaging Server (d[^()]+)| p/SUN JSMS smtpd/ h/$1/ v/$2/
match smtp m|^220 jMailer SMTP Serverrn$| p/jMailer smtpd/
match smtp m/^220[- ][^ ]+ Smail-([^ ]+) .*ESMTP/s p/Smail-ESMTP/ v/$1/
match smtp m/^220[- ][^ ]+ Smail-([^ ]+) / p/Smail/ v/$1/
match smtp m|^220 [([w-_.]+)] ESMTP amavisd-new service readyrn| p/amavisd smtpd/ h/$1/
match smtp m/^220 SMTP-Server Classic Hamster (Vr.|Version) [d.]+ (Build ([d.]+))rn/ p/Classic Hamster smtpd/ v/$2/ o/Windows/
match smtp m|^220-Stalker Internet Mail Server V.([w.]+) is ready.rn| p/Stalker smtpd/ v/$1/ o/Mac OS/
match smtp m|^220-([w-_.]+) Stalker Internet Mail Server V.([w.]+) is ready.rn| p/Stalker smtpd/ v/$2/ h/$1/ o/Mac OS/
match smtp m|^220 ([w-_.]+) ESMTP MailMax ([d.]+) [A-Z][a-z][a-z].*rn| p/MailMax smtpd/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) Mailmax version ([d. ]+) ESMTP Mail Server Ready rn| p/Mailmax smtpd/ v/$2/ h/$1/
match smtp m|^220 ([w-_.]+) running IBM MVS SMTP CS V2R10 on .*rn| p/IBM MVS smtpd/ h/$1/ o/MVS/
match smtp m|^220 [w-_]+ ESMTP ([w-_.]+) (Debian/GNU)rn| p/Postfix smtpd/ h/$1/ o/Linux/ i/Debian/
match smtp m|^220 ESMTP (Debian/GNU Mewwwwwww)rn| p/Postfix smtpd/ o/Linux/ i/Debian/
match smtp m|^220 ([w-_.]+) ESMTP postfix NO UCErn| p/Postfix smtpd/ h/$1/ i/whoson patch/
match smtp m|^220 ([w-_.]+) SMTPD Server - Postfixrn| p/Postfix smtpd/ h/$1/
match smtp m|^220 ([w-_.]+) ESMTP Oracle Email Server SMTP Inbound Servert([d.]+) t Readyrn| p/Oracle smtpd/ v/$2/ h/$1/
match smtp m|^220 ([w-_.]+) Mail essentials server (([d.]+)) ready for ESMTP transferrn| p/Mail essentials for Exchange smtpd/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) ESMTP - WinRoute Pro ([d.]+)rn| p/WinRoute Pro smtpd/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) ESMTP Lyris ListManager service readyrn| p/Lyris ListManager smtpd/ h/$1/
match smtp m|^220 ESMTP Lyris service readyrn| p/Lyris smtpd/
match smtp m|^220 ESMTP Lyris ListManager service readyrn| p/Lyris ListManager smtpd/
match smtp m|^220-([w-_.]+) ESMTPrn220 [w-_.]+ AsyncOSrn| p/IronPort C-60 smtpd/ o/AsyncOS/ d/specialized/
match smtp m|^220 ([w-_.]+) SMTP Ready 12.rn| p/Tunix firewall smtpd/ h/$1/ d/firewall/
match smtp m|^220 ([w-_.]+) ESMTP server (Netscape Messaging Server - Version ([d.]+)) ready .*rn| p/Netscape Messaging Server/ v/$2/ h/$1/
match smtp m|^220 ([w-_.]+) ESMTP SMTPBeamer v([d.]+)rn| p/SMTPBeamer smtpd/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) ZMailer Server ([w.]+) #d+ ESMTP ready at .*rn| p/ZMailer smtpd/ v/$2/ h/$1/ o/Unix/
match smtp m|^220 - zeus SMTPS Sendmail ([w-_.]+)/[w-_.]+; .*n| p/zeus SMTPS smtpd/ v/$1/
match smtp m|^220 Coremail SMTP(Anti Spam) System (w+[(d+)])rn| p/Coremail smtpd/ v/$1/
match smtp m|^220 ([w-_.]+) ESMTP WorkgroupMail ([d.]+) .*rn| p/WorkgroupMail smtpd/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) (PowerMTA v([w.]+)) ESMTP service readyrn| p/PowerMTA smtpd/ v/$2/ h/$1/
match smtp m|^220 ([w-_.]+) ESMTP BorderWare MXtreme Mail Firewallrn| p/BorderWare MXtreme smtpd/ h/$1/ d/firewall/
match smtp m|^220 ([w-_.]+) SMTP Server (JAMES SMTP Server ([d.]+)) ready .*rn| p/JAMES smtpd/ v/$2/ h/$1/
match smtp m|^220 ([w-_.]+) ESMTP MDaemon ([d.]+) readyrn| p/MDaemon smtpd/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 ([w-_.]+)s+ESMTP MDaemon ([d.]+); .*rn| p/MDaemon smtpd/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) ESMTP MDaemon ([d.]+) UNREGISTERED; .*rn| p/MDaemon smtpd/ v/$2/ h/$1/ i/Unregistered/ o/Windows/
match smtp m|^220 ([w-_.]+) ESMTP HT Mail Server v([d.]+); .*rn| p/Icewarp smtpd/ v/$2/ h/$1/
match smtp m|^220 ([w-_.]+) ESMTP Gruponet IE2020 ([d./]+);rn| p/Gruponet mail appliance smtpd/ v/$2/ h/$1/ d/specialized/
match smtp m|^220 ([w-_.]+) mailfront ESMTPrn| p/mailfront smtpd/ h/$1/
match smtp m|^220 ([w-_.]+) SMTP Server SLmail ([d.]+) Ready ESMTP spoken herern| p/SLmail smtpd/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) VaMailArmor-([d.]+)rn| p/VaMailArmor smtpd/ v/$2/ h/$1/
match smtp m|^220 ([w-_.]+) ESMTP MailFrontier (([d.]+))rn| p/MailFrontier smtpd/ v/$2/ h/$1/ d/firewall/
match smtp m|^220 ([w-_.]+) WindowsNT SMTP Server v([w/.]+) ESMTP ready at .*rn| p/WindowsNT SMTP Server smtpd/ h/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) (LSMTP for Windows NT v([w.]+)) ESMTP server readyrn| p/LSMTP smtpd/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) SMTP Mandamail ([d.]+)/[d.]+rn| p/Mandamail smtpd/ v/$2/ h/$1/
match smtp m|^220 Welcome to the QK SMTP Serverrn| p/QK smtpd/ o/Windows/
match smtp m|^220 PostCast SMTP server (http://www.postcastserver.com/) ready at .*rn| p/PostCast smtpd/ o/Windows/
match smtp m|^220 ([w-_.]+) running IBM MVS SMTP CS (w+) on .*rn| p/IBM MVS smtpd/ v/$2/ h/$1/ o/MVS/
match smtp m|^Permission denied - do not try again.rn| p/Hamster smtpd/ i/Access denied/ o/Windows/
match smtp m|^500 Permission denied - closing connection.rn| p/Hamster smtpd/ i/Access denied/ o/Windows/
match smtp m|^220 (SMTP) hMailServer ([d.]+) - Up since .*rn| p/hMailServer smtpd/ v/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) ESMTP hMailServer ([w.-]+)rn| p/hMailServer/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) Ready for action (Mailtraq ([d.]+)/SMTP)rn| p/Mailtraq smtpd/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) SMTP Service Ready (QuickMail Pro Server for MacOS ([d.]+))rn| p/QuickMail Pro smtpd/ v/$2/ h/$1/ o/Mac OS/
match smtp m|^220 ([w-_.]+) HP Sendmail (([d/.]+) .*) ready at .*rn| p/HP Sendmail/ v/$2/ h/$1/ o/HP-UX/
match smtp m|^220-([w-_.]+) Bluecat Networks Inc. Meridius Security Gatewayrn220 | p/Bluecat Meridius smtpd/ d/firewall/
match smtp m|^220 ([w-_.]+) SurgeSMTP (Version ([w.-]+)) http://surgemail.comrn| p/Surgemail smtpd/ v/$2/ h/$1/
match smtp m|^220 ([w-_.]+) Hermes ([d.]+) ML SMTP Ready.rn| p/Hermes smtpd/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 LiteMail SMTP Server Ready.rn| p/LiteMail smtpd/ o/Windows/
match smtp m|^220 ([w-_.]+) SMTP Server (DeskNow SMTP Server ([d.]+)) ready .*rn| p/DeskNow smtpd/ v/$2/ h/$1/
match smtp m|^220 network-box ESMTPrn| p/Network Box smtpd/ d/firewall/
match smtp m|^220-S+ Sendmail ([d.]+)/A/UX ([d.]+) ready at .*rn220 ESMTP spoken herern| p/Sendmail/ v/$1/ i|on A/UX $2| o|A/UX|
match smtp m|^220 ([w-_.]+) sina_smtpd (([d.-]+)) id=d+rn| p/SINA smtpd/ v/$2/ h/$1/
match smtp m|^220 ([w-_.]+) SpearMail SMTP Daemon ready.rn| p/SpearMail smtpd/ h/$1/ o/Windows/
match smtp m|^220 ESMTP on WebEasyMail [([d.]+)] ready. http://www.51webmail.comrn| p/WebEasyMail smtpd/ v/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) AntiVir MailGatern| p/AntiVir MailGate smtpd/ h/$1/
match smtp m|^220 server ESMTP KEN! v([d.]+); .*rn| p/AVM KEN! smtpd/ v/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) NTMail (v([d.]+)/[w.]+) ready for ESMTP transfer rn| p/NTMail smtpd/ v/$2/ h/$1/ o/Windows/
match smtp m|^220-([w-_.]+) Sendmail IBM OS/2 SENDMAIL VERSION ([w./]+) ready at .*rn220 ESMTP spoken herern| p/Sendmail smtpd/ v/$2/ h/$1/ o|OS/2|
match smtp m|^220 imss-2 ESMTP ready at .*rn| p/Trend IMSS smtpd/ o/Windows/
match smtp m|^220 ([w-_.]+) Service ready.rn214- Valid commands are:rn214- HELO MAIL RCPT DATA RSET QUIT NOOPrn214- HELP VRFYrn214- Commands not valid are:rn214- SEND SOML SAML TURNrn.*214- [w-_.]+ is running the OS/400 operating system.rn|s p|OS/400 smtpd| o|OS/400|
match smtp m|^220 shttp.srv Simple Mail Transfer Service Readyrn| p/Small Home Server smtpd/ o/Windows/
match smtp m|^501 Domain must resolvern$| p/odmrd/
match smtp m|^220 ([w-_.]+) ModusMail ESMTP Receiver Version ([d.]+) Readyrn| p/ModusMail smtpd/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 mailmatrix SMTP Server (Mail Matrix Server) ready| p/Mail Matrix smtpd/ o/Windows/
match smtp m|^220 $| p/OpenBSD spamd/
match smtp m|^220-([w-_.]+) ESMTP .* GoMail V([d.]+);| p/GoMail mass mailing plugin smtpd/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 [w-_.]+ Winmail Mail Server ESMTP readyrn| p/Winmail smtpd/ o/Windows/
match smtp m|^220 ([w-_.]+) ESMTP (Code-Crafters Ability Mail Server ([d.]+))rn| p/Code-Crafters Ability smtpd/ v/$2/ h/$1/ o/Windows/
match smtp m|^220 ([w-_.]+) SMTP Welcome to the Internet Anywhere Mail Server Version: ([d.]+). Build: (d+) by True North Software, Inc.rn| p/True North Internet Anywhere smtpd/ v/$2/ i/Build $3/ h/$1/ o/Windows/
# Fairly general
# Giving problems:
#match smtp m|^220 ([w-_.]+) ESMTP ([^;]+); [A-Z][a-z][a-z], .*rn| p/Merak Mail Server smtpd/ h/$1/ o/Windows/
match smtp-proxy m|^220 ([w-_.]+) SMTP/DeleGate/([d.]+) ready at .*rn| p/DeleGate smtpd/ v/$2/ h/$1/
match smtp-proxy m|^220 ([-/.+w]+) SMTP AnalogX Proxy (d[-.w]+) (Release) readyrn| p/AnalogX SMTP proxy/ h/$1/ v/$2/
match smtp-proxy m|^220 ([w-_.]+) ESMTP spamd IP-based SPAM blocker; .*rn| p/spamd smtpd/ h/$1/
match smtp-proxy m|^220 YahooPOPs! Simple Mail Transfer Service Readyrn| p/YahooPOPs! smtpd/
match smtp-proxy m|^220 ESMTP smtprelay service ready.rn| p/GeNUGate firewall smtp relay/ d/firewall/
match smtp-proxy m|^220 ([w-_.]+) Tumbleweed MMS SMTP Relay Service readyrn| p/Tumbleweed smtp proxy/ h/$1/ d/firewall/
match smtp-proxy m|^220 ([w-_.]+) SMTP hotsmtpd v([d.]+). ESMTP-HTTPMail Gateway based on hotwayd.rn| p/hotsmtpd based on hotwayd/ v/$2/ h/$1/
match smtp-proxy m|^220 ([w-_.]+) Welcome SpamFilter for ISP SMTP Server v([d.]+) - Unlicensed Evaluation Copyrn| p/SpamFilter for ISP smtpd/ v/$2/ h/$1/ i/Unregistered/ o/Windows/
match smtp-proxy m|^220 Welcome to the 1st SMTP Serverrn| p/1st SMTP relay/ o/Windows/
match smtp-proxy m|^421 proxyplus.universe SMTP server. Insecure access - terminating.rn| p/Proxyplus smtp proxy/ i/Access denied/ o/Windows/
match smtp-proxy m|^220 AVG ESMTP Proxy Server Beta - ([d./]+) [[d.]+]rn| p/GriSoft anti-virus smtp proxy/ v/$1/ o/Windows/
match smtp-proxy m|^220 AVG ESMTP Proxy Server ([d./]+) [[d.]+]rn| p/GriSoft anti-virus smtp proxy/ v/$1/ o/Windows/
match smtp-proxy m|^554 ([d.]+) ([w-_.]+) No mail servicern| p/Symantec SGS smtp proxy/ v/$1/ h/$2/
match smtp-proxy m|^220 ([w-_.]+) ESMTP Scalix SMTP Relay ([d.]+); .*rn| p/Scalix smtp relay/ v/$2/ h/$1/
match smtp-proxy m|^220 Traffic Inspector SMTP Gate (SPAM protected), ver. ([d.]+), ready at.*rn| p/Smart-Soft spam filtering smtp-proxy/ v/$1/ o/Windows/
match smtp-proxy m|^220 mailwall SMTP Server (Ikarus MailWall by David Grabenweger) readyrn| p/Ikarus MailWall smtp-proxy/
match fw1-topology m|^Q$| p/Checkpoint FW1 Topology/ d/firewall/
softmatch smtp m|^220[s-].*?E?SMTP[^r]*rn|
softmatch smtp m|^572 Relay not authorizedrn| i/Relay not authorized/
match smtp-stats m|^Statistics from .*n M msgsfr bytes_from msgsto bytes_to msgsrej msgsdis Mailern| p/Multi Router Traffic Grapher smtp statistics/
match snpp m|^220 ([-.w]+) SNPP server (HylaFAX (tm) Version ([-.w]+)) ready.rn| p/HylaFAX SNPP/ h/$1/ v/$2/
match snpp m|^220 QuickPage v(d[-.w]+) SNPP server ready at | p/QuickPage SNPP/ v/$1/
match sourceoffice m|^200rnProtocol-Version:(d[.d]+)rnMessage-ID:d+rnDatabase .*rnContent-Length:d+rnrn(w:\.*ini)rnrn| p/Sourcegear SourceOffSite/ i/Protocol $1; INI file: $2/
match ssh m|^$x01x1bNo host key is configured!nr!"v| p/Foundry Networks switch sshd/ i/broken: No host key configured/
match ssh m|^SSH-(d[d.]+)-SSF-(d[-.w]+)n| p/SSF French SSH/ v/$2/ i/protocol $1/
match ssh m|^SSH-(d[d.]+)-lshd_(d[-.w]+) lsh - a free sshrn| p/lshd secure shell/ v/$2/ i/protocol $1/
match ssh m/^SSH-([.d]+)-OpenSSH[_-]([S ]+)/i p/OpenSSH/ v/$2/ i/protocol $1/
match ssh m/^SSH-([.d]+)-Sun_SSH_(S+)/ p/SunSSH/ v/$2/ i/protocol $1/
match ssh m/^SSH-([.d]+)-meow roototkt by rebel/ p/meow SSH ROOTKIT/ i/protocol $1/
match ssh m/^SSH-([.d]+)-(d+.d+.d+) SSH Secure Shell/ p/F-Secure SSH Secure Shell/ v/$2/ i/protocol $1/
match ssh m|^sshd: SSH Secure Shell (d[-.w]+) on ([-.w]+)nSSH-(d[.d]+)-| p/F-Secure SSH Secure Shell/ v/$1/ i/on $2; protocol $3/
match ssh m|^sshd: SSH Secure Shell (d[-.w]+) (([^rn)]+)) on ([-.w]+)nSSH-(d[.d]+)-| p/F-Secure SSH Secure Shell/ v/$1/ i/$2; on $3; protocol $4/
match ssh m|^sshd2[d+]: .*rnSSH-(d[d.]+)-(d[-.w]+) SSH Secure Shell (([^rn)]+))rn| p/F-Secure SSH Secure Shell/ v/$2/ i/protocol $1/
match ssh m/^SSH-([.d]+)-(d+.d+.[-.w]+)/ p/SSH/ v/$2/ i/protocol $1/
# Akamai hosted systems tend to run this - found on www.microsoft.com
match ssh m|^SSH-(d[.d]*)-AKAMAI-In$| p/Akamai-I SSH/ i/protocol $1/
match ssh m|^SSH-(d[.d]*)-Server-Vn$| p/Akamai-I SSH/ i/protocol $1/
match ssh m|^SSH-(d[.d]*)-Server-VIn$| p/Akamai-I SSH/ i/protocol $1/
match ssh m|^SSH-(d[.d]+)-Cisco-(d[.d]+)n$| p/Cisco SSH/ v/$2/ i/protocol $1/
match ssh m|^rnDestination server does not have Ssh activated.rnContact Cisco Systems, Inc to purchase arnlicense key to activate Ssh.rn| p/Cisco CSS SSH/ i/Unlicensed/
match ssh m|^SSH-(d[.d]+)-SSH Protocol Compatible Server SCS (d[-.w]+)n| p/NetScreen SCS sshd/ v/$2/ i/protocol $1/
match ssh m|^SSH-(d[.d]+)-VShell_(d[._d]+) VShellrn$| p/VanDyke VShell/ v/$SUBST(2,"_",".")/ i/protocol $1/
match ssh m/^SSH-([.d]+)-(d[-.w]+) sshlib: WinSSHD (d[-.w]+)rn/ p/Bitvise WinSSHD/ v/$3/ i/protocol $1/ o/Windows/
match ssh m/^SSH-([.d]+)-(d[-.w]+) sshlib: WinSSHDrn/ p/Bitvise WinSSHD/ i/protocol $1; server version hidden/ o/Windows/
# Cisco VPN 3000 Concentrator
# Cisco VPN Concentrator 3005 - Cisco Systems, Inc./VPN 3000 Concentrator Version 4.0.1.B Jun 20 2003
match ssh m/^SSH-([.d]+)-OpenSSHn$/ p/OpenSSH/ i/protocol $1/ d/terminal server/
match ssh m/^SSH-([.d]+)-([.d]+) Radwaren$/ p/Radware Linkproof SSH/ v/$2/ i/protocol $1/ d/terminal server/
match ssh m|^SSH-1.5-Xn| p/Cisco VPN Concentrator SSHd/ i/protocol 1.5/ d/terminal server/
match ssh m|^SSH-([d.]+)-NetScreenrn| p/NetScreen sshd/ i/protocol $1/ d/firewall/
match ssh m|^SSH-1.5-FucKiT RootKit by Cyraxn| p/FucKiT RootKit sshd/ i/protocol 1.5/ o/Linux/
match ssh m|^SSH-2.0-dropbear_([w.]+)rn| p/Dropbear sshd/ v/$1/ i/protocol 2.0/
match ssh m|^Access to service sshd from [w-_.]+@[w-_.]+ has been denied.rn| p/libwrap'd OpenSSH/ i/Access denied/
match ssh m|^SSH-2.0-FortiSSH_([d.]+)n| p/FortiSSH/ v/$1/ i/protocol 2.0/
match ssh m|^SSH-2.0-cryptlibrn| p/APC AOS cryptlib sshd/ i/protocol 2.0/ o/AOS/
match ssh m|^SSH-2.0-1.0 Radware SSH rn| p/Radware sshd/ i|protocols 1.0/2.0| d/firewall/
match ssh m|^SSH-1.5-By-ICE_4_All ( Hackers Not Allowed! )n| p/ICE_4_All backdoor sshd/ i/protocol 1.5/
match ssh m|^SSH-2.0-mpSSH_([d.]+)n| p/mpSSH/ v/$1/ i/protocol 2.0/
# This is a strange one. The linksys WRT45G pretends to be OpenSSH,
# but doesn't do a great job:
match ssh m|^SSH-2.0-OpenSSHrn| p/Linksys WRT45G modified dropbear sshd/ i/protocol 2.0/ d/router/
match ssh m|^SSH-2.0-Unknownn| p/Allot Netenforcer OpenSSH/ i/protocol 2.0/
match ssh m|^SSH-2.0-FrSAR ([d.]+) TRUEX COMPT 32/64rn| p/FrSAR truex compt sshd/ v/$1/ i/protocol 2.0/
match ssh m|^SSH-2.0-(d+)n| p/Netpilot config access/ v/$1/ i/protocol 2.0/
match ssh m|^SSH-2.0-RomCliSecure_([d.]+)rn| p/Adtran Netvanta RomCliSecure sshd/ v/$1/ i/protocol 2.0/
match ssh m|^SSH-2.0-([d.]+) sshlib: GlobalScapern| p/GlobalScape CuteFTP sshd/ v/$1/ o/Windows/
match ssh m|^SSH-2.0-APSSH_([w.]+)n| p/APSSHd/ v/$1/ i/protocol 2.0/
match ssh m|^SSH-2.0-Twistedrn| p/Kojoney SSH honeypot/ i/protocol 2.0/
softmatch ssh m/^SSH-([.d]+)-/ i/protocol $1/
match soldat m|^Soldat Admin Connection Established...rnAdmin connected.rn| p/Soldat multiplayer-game server/
match solproxy m|^The solproxy is used by [d.]+nrThe client is closed!nr| p/Dell Serial Over LAN proxy/
match subethaedit m|^RPY d d . d d+rnContent-Type: application/beep+xmlrnrn<greeting><profile uri="http://www.codingmonkeys.de/BEEP/SubEthaEditHandshake"| p/SubEthaEdit collaborative text editor/ o/Mac OS X/
match synergy m|^x0bSynergyx01x02| p/Synergy KVM/
# Redhat Linux 7.1 - HAHAHAHAHAHA!!!! I love this service :)
match systat m|^USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMANDn| p/Linux systat/ o/Linux/
# Draytek Vigor 2600 aDSL router
match telnet m|^xffxfdx18xffxfbx01nrnrPassword: | p/Draytek Vigor aDSL router telnetd/ d/broadband router/
# IBM Infoprint 12 printer with JetDirect
match telnet m|^xffxfcx01rnPlease type [Return] two times, to initialize telnet configurationrnFor HELP type "?"rn> | p/HP JetDirect printer telnetd/ d/printer/
# HP JetDirect 300X print server
match telnet m|^xffxfcx01rnHP JetDirectrnrnPassword:$| p/HP JetDirect printer telnetd/ d/printer/
# IBM High Performace Switch - Model 8275-416, Software version 1.1, Manufacturer IBM068
match telnet m|^x1b[Hx1b[2JYou have connected to a FirstClass System. Please login...rnUserID: | p/FirstClass messaging system telnetd/
# Cisco Catalyst management console
# 3Com 3Com SuperStack II Switch 3300
match telnet m|^xffxfdx03xffxfbx03xffxfbx01| i|Usually a Cisco/3com switch| d|switch| o/IOS/
match telnet m|^xffxfbx03xffxfbx01rnSun(tm) Advanced Lights Out Manager (d[-.w]+) (v(d+))rnrnPlease login: | p/Sun Advanced Lights Out Manager/ v/$1/ i/on Sun v$2; for remote system control/ d/remote management/
# Epson Stylus Color 900N telnet
match telnet m|^xffxfbx01xffxfbx01Connected to [-/.+w]+!rnrnPassword: | p/Epson printer telnetd/ d/printer/
# This one may not technically be considered telnet protocol, but you seem to use it via telnet
match telnet m|^220 SL4NT viewer service readyrn250 Currently connected channels: | p/Netal SLANT viewer/
match telnet m|^xffxfbx03xffxfbxffxfbxffxfdxff.*rrFrontDoor (d[-.w]+)/|s p/FrontDoor FIDONet Mailer telnetd/ v/$1/
match telnet m|^xffxfbx01xffxfbx03rnOKrn$| p/Motorola Vanguard router telnetd/ d/router/
match telnet m|^xffxfbx03xffxfdx03xffxfcx06.*nPrecidia Technologiesrn([-.+w]+) Remote ConfigurationrnnPassword? |s p/Precidia serial2ethernet gateway telnetd/ i/model $1/
match telnet m|^xffxfbx01.*nrWelcome to the Xylan PizzaSwitch! Version (d[-.w]+)nrlogin : |s p/Xylan PizzaSwitch telnetd/ v/$1/ d/switch/
# Bay Networks Accelar 1100 (version 2.0.5.5) switch
match telnet m|^xffxfbx01rnr********************************nrr* Bay Networks,Inc..*(Accelar [-.+w]+).*Software Release (d[-.w]+) |s p/Bay Networks Accelar switch telnetd/ v/$2/ i/$1/ d/switch/
match telnet m|^xffxfbx01rnr********************************nrr* Nortel Networks,Inc..*nrr* Passport ([-.w]+) .*r* Software Release (d[-.w]+) |s p/Nortel Networks Passport switch telnetd/ v/$2/ i/Passport $1/ d/switch/
# NCD Thinstar 300 running NCD Software 2.31 build 6
match telnet m|^xffxfbx03xffxfdx03xffxfbx01WinCE/WBT Command Shell Version (d[-.w]+)rnSerial Number: (w+) MAC Address: 0000(w+)rnUUID: [-w]+rnPassword: | p/NCD Thinster terminal command shell/ v/$1/ i/Serial# $2; MAC $3/ d/terminal/
# Netopia 4542 aDSL router telnetd
match telnet m|^xffxfbx01xffxfdx03xffxfbx03x1b[2Jx1b[Hname:| p/Netopia aDSL router telnetd/ d/broadband router/
# NetportExpress PRO/100 3 port print server
match telnet m|^xffxfbx01rnNetportExpress(tm) ([-/.+w]+)rn.*rnrnlogin: | p/Intel NetportExpress print server telnetd/ i/Model $1/ d/print server/
# 3Com OfficeConnect 812 Router telnetd
match telnet m|^login: xffxfdx03xffxfbx03xffxfbx01| p/3Com OfficeConnect router telnetd/ d/router/
# Nortel Networks Instant Internet 100
match telnet m|^xffxfbx01rnpassword: | p/Nortel Networks Instant Internet broadband router telnetd/ d/broadband router/
# Network Appliance ONTAP 6.3.3 telnet
match telnet m|^xffxfbx01xffxfdx18xffxfd#| p/Network Appliance Ontap telnetd/
# Netgear RP114 broadband router
match telnet m|^xffxfbx03xffxfbx01rnPassword: | p/Netgear broadband router admin telnetd/ d/broadband router/
match telnet m|xffxfdx18xffxfbx01x1b[2Jx1b[?7lx1b.*HP ([-.w]+) ProCurve Switch ([-.w]+)rnrFirmware revision ([-.w]+)rnrr| p/HP ProCurve Switch telnetd/ i/Model: $2; Firmware: $3/
match telnet m|^Check Point FireWall-1 Client Authentication Server running on [-.w]+rnrxffxfbx01xffxfex01xffxfbx03User: | p/Check Point FireWall-1 Client Authenticaton Server/
# Enterasys XP-8600 running E9.0.5.0
match telnet m|^xffxfbx03xffxfdx01xffxfdx1fxffxfbx05xffxfd!| p/Enterasys XSR Security Router telnetd/ d/router/
# Windows 2000 telnetd
match telnet m|^xffxfd%xffxfbx01xffxfdx03xffxfdx1fxffxfdxffxfb$| p/Microsoft Windows 2000 telnetd/ o/Windows/
match telnet m|^xffxfdx03xffxfbx03xffxfd'xffxfdx18xffxfbxffxfdxffxfbx01xffxfex01GUI STARTn| p/Microsoft Windows 2000 telnetd/ o/Windows/
match telnet m|^xffxfbx01xffxfbx03xffxfd'xffxfdx1fxffxfdxffxfbWelcome to Microsoft Telnet Service rn| p/Microsoft Windows 2000 telnetd/ o/Windows/
match telnet m|^xffxfbx01xffxfdx03xffxfdx1fxffxfdxffxfbMicrosoft (R) Windows (TM) Version (d[-.w]+) (Build (d+))rnWelcome to Microsoft Telnet Service rnTelnet Server Build (d[-.w]+)nrlogin: | p/Microsoft Windows telnetd/ v/$3/ i/OS version $1 build $2/ o/Windows/
# Windows XP telnetd
match telnet m|^xffxfd%xffxfbx01xffxfbx03xffxfd'xffxfdx1fxffxfdxffxfb| p/Microsoft Windows XP telnetd/ o/Windows XP/
# IRIX 6.5.18f telnetd
match telnet m|^xffxfdx18xffxfd xffxfd#xffxfd$| p/IRIX telnetd/ v/6.X/ o/IRIX/
# OS 400 V4R4M0
# OS/400 V5R1M0
match telnet m|^xffxfd'xffxfdx18$| p|IBM OS/400 telnetd| o|OS/400|
# JetDirect Model: J4169A Firmware: L.21.11
match telnet m|^xffxfbx03xffxfbx01x07HP JetDirectrnPassword is not setrn| p/HP JetDirect printer telnetd/ i/No password/ d/printer/
# HP Jetdirect telnet with password protection
match telnet m|^xffxfbx03xffxfbx01x07HP JetDirectrnrnEnter username: | p/HP JetDirect printer telnetd/ d/printer/
# HP MPE/iX 5.5 on HP 3000 telnet service
match telnet m|^xffxfdx03xffxfbx01xffxfd!| p|HP MPE/iX telnetd|
# Brother 1870N Printer
match telnet m|^x1b[2Jx1b[1;1fxffxfbx01xffxfbx03xffxfdx03| p/Brother printer telnetd/ d/printer/
# AIX 4.3.3.0
match telnet m|^xffxfe%xffxfdx18$| p/AIX telnetd/ o/AIX/
match telnet m|^rnEfficient ([-.w ]+) Router (([-.d/]+)) v(d[-.w]+) Readyrnxffxfbx01xffxfbx03xffxfdx01xffxfex01Login: | p/Efficient router telnetd/ v/$3/ i/Model $1 - $2/ d/router/
# http://mldonkey.berlios.de/
# mldonkey-2.5-3 telnet port
match telnet m|^xffxfdx1fnn***************************************************************************nn Welcome to MLdonkey n| p/MLdonkey multi-network P2P admin port/
match telnet m|^rnRaptor Firewall Secure Gateway.rn| p/Symantec Raptor firewall secure gateway telnetd/
match telnet m|^rnSynchronet BBS for Win32 Version (d[-.w]+)rn| p/Synchronet BBS/ v/$1/ i/on Win32/
match telnet m|^xffxfbx01xffxfbx03rnlogin: $| p/Orinoco WAP telnetd/
match telnet m|^xffxfdx03xffxfbx01xffxfbx03x1b[1;1Hx1b[2Kx1b[2;1Hx1b[2Kx1b[3;1Hx1b.*Nortel Networks.*BayStack ([-.w]+).*Versions: ([.: w]+)|s p/Nortel Networks telnetd/ i/Baystack $1; Versions: $2/ d/switch/
match telnet m|^xffxfdx03xffxfbx01xffxfbx03x1b[1;1Hx1b[2Kx1b[2;1Hx1b[2Kx1b[3;1Hx1b.*BayStack ([w-_.]+) .*HW:(w+) FW:V([d.]+) SW:V([d.]+)x1b|s p/BayStack switch $1 telnetd/ v/HW:$2 FW:$3 SW:$4/ d/switch/
# ASCII art banner that says "BAYSTACK"
match telnet m|^xffxfbx01x1b[2Jx1b[58259456;1Hx1b[0mx1b[1;1H ***** *** * * ***** ********* *** ***** * *x1b[2;1H| p/BayStack switch telnetd/ d/switch/
match telnet m|^xffxfbx01nrn.*Bay Networks (Bay[-.: w]+)nr|s p/Bay Networks telnetd/ i/$1/
match telnet m/^Check Point FireWall-1 authenticated Telnet server running on/ p/Check Point Firewall-1 telnetd/
match telnet m/^rnSpeedStream ([^(rn]+) (.*) v(S+) Readyrnxffxfbx01xffxfbx03xffxfd/ p/SpeedStream $1/ v/$2/
match telnet m|^xffxfbx01rnrType "?" at the command prompt for a list of commands.nr.*Command-> |s p/SpeedStream 5660 router telnetd/ d/router/
# Alcatel SpeedTouch 510 ADSL router - Admin Interface, version 4.0.2.0.0
match telnet m|^xffxfbx01xffxfbx03xffxfbx01xffxfbx03Username : | p|Alcatel/Thomson SpeedTouch DSL router admin interface| d/broadband router/
match telnet m/^rnRaptor Firewall Secure Gateway.rnrnAccess denied.rn/ p/Symantec Raptor Firewall Secure Gateway telnetd/ i/Access Denied/
match telnet m/^******* System Image Boot *******nrnrVina Technologies (.*) ((d[-.w]+ build d+))nr/ p/Vina Technologies $1 telnetd/ v/$2/
match telnet m/^xffxfbx01xffxfdx03xffxfbx03x1b[0mx1b[2Jx1b[01;00HrGigalink ([-+ w]+)/ p/Gigalink telnetd/ i/on $1/
match telnet m/^xffxfbx03xffxfb.*D-Link.*Telnet Console.*Models+: ([-+w]+)/s p/D-Link telnetd/ i/on $1/
match telnet m|^xffxfbx01x1b[0mx1b[2Jx1b[0mx1b[9;20HCopyright(C) 1995-99 D-Link Systems Inc.x1b[13;30HUser Namex1b[14;30HPasswordx1b[23;10HMAC Address:x1b[8;29H([-.w]+) Console Programx1b[13;41H| p/D-Link switch admin interface/ i/D-Link $1/
match telnet m/^xffxfax18x01xffxf0xffxfbx01xffxfbx03Ambit Cable RouterrnrnLogin: / p/Ambit Cable Router telnetd/ d/broadband router/
match telnet m|^xffxfcx01rnHP JetDirectrnrnPlease type "?" for HELP, or "/" for current settingsrn> $| p/HP JetDirect telnetd/ d/printer/
match telnet m/^nrVina Technologies (.*) ((d[-.w]+ build d+))/ p/Vina Technologies $1 telnetd/ v/$2/
match telnet m/^xffxfdx03xffxfbx03xffxfbx01x1b[0mx1b[1;1Hx1b[2JrDr nr (DES-.*) Command Line Interfacenrn/ p/D-Link $1 telnetd/
match telnet m/^xffxfbx01xffxfbx03xffxfcx1fnrnrUser Access VerificationnrnrnrnrnrShell version (dS+).*Maipu Communication Technology Co./ p/Maipu Router/ i/shell v$1/ d/router/
match telnet m/^xffxfbx01xffxfbx03xffxfdx03x1b.*Intel Corporation, ([-+. w()]+)/s p/Intel telnetd/ i/on $1/
match telnet m|^rnFlowPoint/(.*) Readyrn.*xffxfbx01xffxfb| p/Flowpoint telnet/ i/on $1/
match telnet m/Welcome to Tenor Multipath Switch Telnet Server.*Type: (S+)/s p/Tenor telnetd/ v/$1/ i/on Multipath Switch/
match telnet m|^xffxfbx01xffxfbx03xffxfdx01x0dx0ax0dx0aCiscox20Systems.*Console/Telnet Access of the ([-. w]+) for Configuration Purposes|s p/Cisco $1 telnetd/
# Cisco 350 Series Wireless AP 11.05
match telnet m|^xffxfbx01nrx08x08x08x08x08x08x08x08x08x08x08x08x08x08x08x08x08x08x08x08x08x08x08x08x08x08x08 x08x08x08x08x08x08x08x08x08x08x08x08x08x08x08| p/Cisco WAP telnetd/ d/WAP/
# Cisco 678 DSL router
match telnet m|^rnrnUser Access VerificationrnPassword:xffxfbx01$| p/Cisco DSL router telnetd/ d/broadband router/
# Cisco 2900 Catalyst switch, IOS 12.0(5)XU
# Cisco 3600 router running IOS 12.X
# Cisco 2600 IOS 12.0
match telnet m/^xffxfbx01xffxfbx03xffxfdx18xffxfdx1f.*User Access Verificationrnrn(Username|Password): $/s p/Cisco telnetd/ o/IOS 12.X/ d/switch/ o/IOS/
# Cisco Pix 501 PIX IOS 6.3(1) telnet
match telnet m/^xffxfbx03xffxfbx01xffxfbx03xffxfbx01.*rnUser Access VerificationrnrnPassword: /s p/Cisco telnetd/ o/IOS 6.X/ d/firewall/
# Cisco Catalyst 6509 - WS-C6509 Software, Version NmpSW: 5.5(1)
match telnet m|^xffxfbx01xffxfbx03xffxfdx01rnrnCisco Systems Consolern| p/Cisco Catalyst switch telnetd/ d/switch/ o/IOS/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18xffxfdx1frnrnPassword required, but none setrn| p/Cisco router telnetd/ i/password required but not set/ d/router/
match telnet m|^Access not permitted. Closing connection...n$|s p/Cisco catalyst switch telnetd/ i/access denied/ d/switch/
match telnet m|^xffxfdx18$| p/Cisco microswitch telnetd/ d/switch/
# OpenBSD 2.3
# FreeBSD 5.1
match telnet m|^xffxfd%$| p/BSD-derived telnetd/
# Solaris 9
match telnet m|^xffxfdx18xffxfdx1fxffxfd#xffxfd'xffxfd$$| p/Sun Solaris telnetd/ o/Solaris/
# Redhat Linux 7.3 telnet
match telnet m|xffxfdx18xffxfd xffxfd#xffxfd'$| p/Linux telnetd/ o/Linux/
match telnet m|^xffxfbx01nrUser Name : $| p/APC network management card telnetd/ d/power-device/
match telnet m|^xffxfbx01xffxfbx03xffxfdx03nrUser Name : | p|APC telnetd| i|Power/UPS device| d|power-device|
# G-Net BB0060 ADSL Modem
match telnet m|^xffxfbx01xffxfdx03xffxfbx03nr *******************nr.*GlobespanVirata Inc., Software Release ([-.w]+)nr|s p/GlobespanVirata telnetd/ v/$1/ d/broadbrand router/
# HP-UX B.11.00 A
match telnet m|^xffxfd$$| p/HP-UX telnetd/ o/HP-UX/
# Cayman-DSL Model 3220-H, DMT-ADSL (Alcatel) OS version 6.3.0
match telnet m|^xffxfbx01xffxfbx03xffxfex01nrlogin: $| p/Cayman-DSL router telnetd/ d/broadband router/
# Blue Coat Port 80 Security Appliance Model: Blue Coat SG400 Software Version: SGOS 2.1.6044 Software Release id: 19480 Service Pack 4
# Maybe I should call this SGOS telnetd instead
match telnet m|^xffxfbx03xffxfbx01xffxfdx1frnrnUsername: $| p/Blue Coat telnetd/
match telnet m|^xffxfbx01@ Userid: | p/Shiva LanRover telnetd/
# Netscreen ScreenOS 4.0.1r1.0 telnetd on a netscreen 5XT running firmware 4.0.1r1.0
match telnet m|^xffxfdx18xffxfbx01(xffxfex01)?(xff.x03)?[w ]*Remote Management Consolern(rn)?login: $| p/Netscreen ScreenOS telnetd/ d/firewall/
# Note that openwall telnetd is derived from OpenBSD telnetd
match telnet m|^xffxfdx18xffxfd xffxfd#xffxfd'xffxfd$$| p|Openwall GNU/*/Linux telnetd| o|Linux|
match telnet m|^xffxfcx01rnHP JetDirectrnrnPlease type "?" for HELP, or "/" for current settingsrn> $| p/HP Jet Direct printer telnetd/ d/printer/
match telnet m|^xffxfbx01xffxfbx03rnAXIS (S+) TELNET| p/AXIS Webcam/ v/$1/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18xffxfdx1frnrnTelebit's NetBlazer Version (S+)rn| p/Telebit NetBlazer/ v/$1/
match telnet m|^xffxfbx01xffxfbx03xffxfdx03.*?FOREx20Systems,x20FOREx20ES-2810.*?Version (d[d.-]+)| p/FORE Systems ES-2810/ v/$1/
match telnet m|^xffxfbx03xffxfbx01.*ForeRunner ES-3810.*Enter Username: | p/FORE Systems ES-3810/
match telnet m|^xffxfbx01rnCopyright (C) 1999 by Extreme Networksrrn| p/Extreme Networks telnetd/
match telnet m|^xffxfbx01xffxfdx03xffxfbx03.*?ES-1000x20Fastx20Ethernetx20Switchx20Console| p/Marconi ES-1000/
match telnet m|^xffxfbx01login:x20$| p/telnet/ i/generic/
match telnet m|^xffxfbx01xffxfdx01xffxfbx03xffxfdx03xffxfbx05xffxfdx05Welcome to ([w-_]+) Debug Terminal - d*nrnrnrlogin:| p/hp StorageWorks SSL1016 tape autoloader telnetd/ i/Name: $1/
match telnet m|^xffxfbx01xffxfdx03xffxfbx03rnrnWelcome to Print ServerrnrnPS>| p/Micronet or Linksys print server telnetd/ d/Print Server/
match telnet m|^x1b[0mx1b[2Jx1b[01;28HCONEXANT SYSTEMS, INC.x1b[02;19H ACCESS RUNNER ADSL CONSOLE PORTx1b[24;01H>>>x1b[24;01HLOGON PASSWORD>x1b[02;53H3.d+x1b[24;17Hx1b[24;17Hx1b[24;17Hx1b[24;17H| p/Conexant Access Runner adsl router telnetd/ d/router/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18xffxfdx1frnrnWelcome on (.*)rnrnrnUsername: | p/Cisco Router 2621 telnetd/ i/Banner: $1/
match telnet m|^xffxfbx01xffxfdx18nTelnet Service on the PrintServernnrPassword: | p|Hawking/TRENDnet Print Server telnetd| d/print server/
match telnet m|^xffxfbx01xffxfbx03rnrn Welcome to OpenVMS (TM) Alpha Operating System, Version V([d.]+) rnrnrUsername: | p/OpenVMS telnetd/ o/OpenVMS $1/
match telnet m|^xffxfbx01xffxfbx03xffxfdx01x1b[0;37;40mx1b[2Jx1b[0;37;40mx1b[1mx1b[5;27HVertical Horizon Stack Managerx1b[0;37;40mx1b[1mx1b[10;26HEnterasys Networks, Incorporated| p/Enterasys Vertical Horizon Manager/ d/switch/
match telnet m|^xffxfd($| p|IBM OS/390 or SNA telnetd|
match telnet m|^xffxfbrnRemotelyAnywhere Telnet Server v([d.]+)rn.*rnrn([w-_. ]+) loginrnuser name: | p/RemotelyAnywhere telnetd/ v/$1/ i/Name $2/ o/Windows/
match telnet m|^xffxfbx01xffxfbx03nRICOH Maintenance Shell. ([w:]+)nrUser access verification.nrPassword:| p/RICHOH Maintenance telnetd/ i/MAC $1/ d/print server/
match telnet m|^rnVxWorks login: xffxfbx01$| p/VxWorks telnetd/ o/VxWorks/
match telnet m|^xffxfbx01xffxfdx01xffxfbx03xffxfdx03xffxfbx01xffxfdx01xffxfbx03xffxfdx03rnrnSelect Access Levelrn===================rn1 - Read-Onlyrn2 - Installerrn3 - Administratorrn13008 >>> | p/BreezeCOM telnetd/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18xffxfdx1frnExterior router [w-_.]+rnType: Cisco 2651rnModule: E3/T3 interfacernrn| p/Cisco 2651 router telnetd/ o/IOS/ d/router/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18xffxfdx1frn[w-_.]+>%| p/Cisco router telnetd/ o/IOS/ d/router/
match telnet m=^xffxfbx01rnrn#rn| ELSA, MicroLink Cablern| Ver. ([d.]+) / [d.]+ dd:dd .*rn| SN. d+rn| Copyright (c) ELSA AG, Aachen (Germany)rnrncm2, Connection No.: d+ (LAN) (read-only connection)rnrnPassword:= p/ELSA Microlink Cable modem/ v/$1/ i/read-only connection/ d/router/
match telnet m|^xffxfbx03xffxfbx01rnrnpassword: $| p/Cisco LocalDirector telnetd/ d/load balancer/
match telnet m|^xffxfbx01xffxfbxffxfdxfbxffxfdx03x1b[Hx1b[2JYou have connected to a FirstClass System. Please login...rnUserID: | p/FirstClass telnetd/
match telnet m|^xffxfdx1fxffxfdx18xffxfbx01xffxfbx03nWelcome to GoodTech Telnet Server for Windows 95/98 (V([d.]+)) (Evaluation Copy)nrn(C) Copyright d+-d+ GoodTech Systems, Inc.nrnnLogin username: | p/GoodTech telnetd/ v/$1/ o/Windows/
match telnet m|^Please wait ... Connecting ...| p/Java Object Oriented Telnet Talker/
match telnet m|^xffxfex01xffxfbx01xffxfdx03xffxfbx03xffxfdx18Georgia SoftWorks Telnet Server for Windows NT/2000/XP/2003 Ver. ([d.]+)nrEvaluation copy, d+ users enabled. Expiration date is d+/d+/d+.nrnrPlease wait...nrUser d+ of d+nrnrnrlogin:| p/Georgia SoftWorks telnetd/ v/$1/ i/Evaluation copy/ o/Windows/
match telnet m|^xffxfex01xffxfbx01xffxfdx03xffxfbx03xffxfdx18Georgia SoftWorks Telnet Server for Windows NT/2000/XP Version ([d.]+)nrYour evaluation copy of this product expired, disconnecting...| p/Georgia SoftWorks telnetd/ v/$1/ i/Expired trial/ o/Windows/
match telnet m|^xffxfex01xffxfbx01xffxfdx03xffxfbx03xffxfdx18Georgia SoftWorks Telnet Server for Windows NT/2000/XP/2003 Ver. ([d.]+)nrRegistered copy, d+ users enabled.nrnrPlease wait...nrUser d+ of d+nrnrnrlogin:| p/Georgia SoftWorks telnetd/ v/$1/ i/Registered version/ o/Windows/
match telnet m|^xffxfdx03xffxfbx01rnrnttWelcome to X330WAN-2DS1rnttSW version ([d.]+)rnrnrnLogin: | p/Avaya X330WAN-2DS1 telnetd/ v/$1/ d/router/
match telnet m|^xffxfdx01xffxfdx1fxffxfd!xffxfbx01xffxfbx03rrnrnrnBusyBox v([w-.]+) (.*) Built-in shell (ash)rnEnter 'help' for a list of built-in commands.rnrn.*root@OpenWrt:/# |s p/OpenWRT telnetd/ i/open; BusyBox $1/
match telnet m|^x1b[0mx1b[2Jx1b[01;28HCONEXANT SYSTEMS, INC.x1b[02;14HATU-R ACCESS RUNNER ADSL TERMINALx1b[24;01HENTER CHOICE-->| p/Conexant ATU-R ADSL router telnetd/ d/router/
match telnet m=^xffxfbx01xffxfbx03rnrn#rn| LANCOM L-54g Wirelessrn|= p/LANCOM L-54g Wireless router telnetd/ d/router/
match telnet m|^xffxfcx01rnHP JetDirectrnrnPassword: | p/HP JetDirect telnetd/ d/printer/
match telnet m|^xffxfbx01xffxfbx03xffxfdx01rnrnCisco Systems, Inc. ConsolernrnrnrnrnEnter password: | p/Cisco Catalyst switch telnetd/ d/switch/ o/IOS/
match telnet m|^xffxfbx03xffxfbx01rnrnComOS - Livingston PortMasterrnrnlogin: | p/Livingston Portmaster telnetd/ d/telecom-misc/
match telnet m|^xffxfbx01xffxfdx03xffxfbx03nr +*+nr +Welcome to DSLink 200 U/Enr +*+nrnrGlobespanVirata Inc., Software Release VIK-([w.]+)nr| p/DSLink 200 adsl modem telnetd/ v/Software version $1/ d/router/
match telnet m|^xffxfex01xffxfdx03xffxfdx18xffxfdx1fxffxfdxffxfbx03xffxfbx01xffxfbThis copy of the Ataman TCP Remote Logon Services is registered as licensed to:rnt(.*)rnrnAccount Name: | p/Ataman TCP Remote Logon Service telnetd/ i/Registered to $1/ o/Windows/
match telnet m|^xffxfbx01xffxfbx03xffxfdx03xffxfdx1fxffxfdx18Windows NT Workstation ([d.]+) (build d+) Service Pack (d+)rnRemotelyAnywhere Telnet Server ([d.]+)rn| p/RemotelyAnywhere telnetd/ v/$3/ i/WinNT $1 SP$2/ o/Windows/
match telnet m|^rnSorry, Access to Telnet is Denied.rn$| p/Motorola VT1000v VOIP Adapter telnetd/ i/Access denied/ d/VoIP adapter/
match telnet m|^xffxfbx01xffxfbx03rnrn[ORiNOCO-AP-600-[w-]+]> Please enter password: | p/ORiNOCO AP 600 telnetd/ d/router/
match telnet m|^xffxfbxfdxffxfbx01nrnrFabric OS (tm) Release v([w.]+)nrnr| p/Brocade SilkWorm switch telnetd/ i/Fabric OS $1/ d/switch/
match telnet m|^xffxfbx05xffxfdx1fxffxfdx01xffxfbx03Nortel Networks CVX Access Switchrnlogin: | p/Nortel CVS Access switch telnetd/ d/switch/
match telnet m|^xffxfbx01nr-> x08x08x08x08 *** EPSON Network Print Server (([^)]+)) ***nrnrx08x08x08x08 nrPassword: | p/EPSON Network print server telnetd/ v/$1/ d/print server/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18rnnLantronix MSS100 Version V([d.]+)/d+(d+)nrnType HELP at the 'Local_2> ' prompt for assistance.nrnrnnUsername> | p/Lantronix MSS100 serial interface telnetd/ v/$1/ d/specialized/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18rrrnx07# | p/Lantronix MSS100 serial interface telnetd/ d/specialized/
match telnet m|^xffxfbx01OPTIBASE MGW5100 COMMAND LINE INTERFACErn| p/Optibase MGW5100 TV streaming device telnetd/ d/media device/ o/VxWorks/
match telnet m|^rnVideolan Server Administration Systemrnrnxffxfbx01xffxfbx03xffxfe"Login: | p/Videolan Server telnetd/ d/media device/
match telnet m=^xffxfbx01rnrn#rn| ELSA LANCOM DSL/I-10 Officern| Ver. ([d.]+) / [d.]+rn| SN. (d+)rn= p/Elsa DSL I-10 router telnetd/ v/$1/ i/SN $2/ d/router/
match telnet m|^PC Telnetd ([d.]+)rnrnlogin: | p/PC Telnetd/ v/$1/ o/Windows/
match telnet m|^rn>>> DECT@NET D&T Agent <<<rnrnlocal> | p/Philips DECT D&T Agent telnetd/
match telnet m=^xffxfbx01xffxfdx03xffxfbx03x1b[Hx1b[2Jx1b[0mx1b[0mx1b[0mx1b[Hx1b[2Jx1b[0m +-++rn | NuSight GEMS Console +Version v([d.]+) |rn | Copyright (c) 1998-2001, NPI +|rn= p/NPI Keystone switch telnetd/ v/$1/ d/switch/
match telnet m|^xffxfbx03xffxfbx01rnCopyright d+ Sun Microsystems, Inc. All rights reserved.rnUse is subject to license terms.rnrnrnSun(tm) Advanced Lights Out Manager ([d.]+) (setup)rnrnPlease login: | p/Sun Advanced Lights Out Manager telnetd/ v/$1/ d/Solaris/
match telnet m|^rsconfig: port rose not activenxffxfd"rnLinuxNode v([d.]+) (([w-_.]+))rnrnlogin: | p/LinuxNode telnetd/ v/$1/ h/$2/ o/Linux/
match telnet m|^xffxfd"rnLinuxNode v([d.]+) (([w-_.]+))rnrnlogin: | p/LinuxNode telnetd/ v/$1/ h/$2/ o/Linux/
match telnet m|^xffxfdx01xffxfd!xffxfbx01xffxfbx03rrnrnrnBusyBox v([w-_.]+) ([^)]+) Built-in shell (ash)rnEnter 'help' for a list of built-in commands.rnrn# | p/MacSense HomePod Wireless MP3 Player telnetd/ i/BusyBox $1/ d/media device/
match telnet m|^xffxfdx01xffxfd!xffxfbx01xffxfbx03rnrnBusyBox v([w-_.]+) ([^)]+) Built-in shell (ash)rnEnter 'help' for a list of built-in commands.rnrn# | p/Netgear DG834G telnetd/ i/BusyBox $1/ d/router/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18xffxfdx1frnRouter>| p/Cisco 806 router telnetd/ d/router/ o/IOS/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18rnrnUser Access VerificationrnrnPassword: | p/Cisco 2514 router telnetd/ d/router/ o/IOS/
match telnet m|^xffxfdx01xffxfbx01xffxfdx03xffxfbx03xffxfe"xffxfc"x1b[2Jx1b[3;0Hx1b[0mLogin Menu x1b[mx1b[4;0Hx1b[0m_+x1b[mx1b[1;0Hx1b[0mMCT-2114 Version ([d.]+) x1b[mx1b[20;10Hx1b[0m| p/MCT-2114 switch telnetd/ v/$1/ d/switch/
match telnet m|^xffxfdx01xffxfd!xffxfbx01xffxfbx03rnAmiNETd+ login: | p/Amino AmiNET set-top box telnetd/ d/media device/
match telnet m|^xffxfbx01xffxfbx03rnMSDOS [d.]+ Windows [d.]+ ([d.]+) (ttypd)rnrnlogin: | p/Windows for Workgroups telnetd/ o/Windows/
match telnet m|^xffxfbx03xffxfbx01rnrnx07HP (w+) Ethernet SNMP Modulern ROM B.([d.]+)rn EEPROM A.([d.]+)rn HW B.([d.]+)rnrnEnter password: | p/HP AdvanceStack $1 Ethernet hub SNMP Module telnetd/ i/ROM $2; EEPROM $3; HW $4/ d/hub/
match telnet m|^USR5450 Telnet server v([d.]+)nrnPassword : | p/USR5450 access point telnetd/ v/$1/ d/router/
match telnet m|^xffxfbxffxfdxffxfbx01xffxfbx03xffxfdx03x1b[1}x1b[0;37;40mx1b[2Jx1b[1;1HLogin Name: | p/HP Integrated Lights Out remote configuration telnetd/ d/remote management/
match telnet m|^xffxfbx01x1b[mx1b[mx1b[mx1b[mx1b[mx1b[16;35Hx1b[1;1Hx1b[2Jx1b[16;35Hx1b[1;1HLogin Screenx1b[8;5HCopyright (c) d+-d+ Enterasys Networks, Inc. All rights reservedx1b.*RoamAbout R2x1b|s p/Enterasys RoamAbout WAP router telnetd/ d/router/
match telnet m|^Welcome to the OfficeConnect(TM) LAN modem Telnet ServernrConnected From IpAddr/Port# w+/d+ To Port# d+nrnLANmodem> Password: | p/3Com OfficeConnect LAN modem telnetd/ d/router/
match telnet m|^xffxfbx03xffxfbx01rnn*+rn* Welcome to Telnet Console *rn*+rnrnServer Name : [^]+rnModel +: DP-([d.]+)rnFirmware Version : ([d.]+) rnMAC Address : ([w ]+)rnUp Time : ([^rn]+)rn| p/D-Link DP-$1 router telnetd/ i/Firmware $2; MAC $3; Uptime $4/ d/router/
match telnet m|^xffxfdx03xffxfbx03xffxfdx01xffxfbx01dd-w+-d+ dd:dd:dd %MSCM-I-NEWTERM: New TELNET connection from ([d.]+)rrnPassword:| p/Dell PowerConnect switch telnetd/ d/switch/
match telnet m|^xffxfdx03xffxfbx03xffxfdx01xffxfbx01User Name:| p/Dell PowerConnect switch telnetd/ d/switch/
match telnet m|^xffxfbx03xffxfbx01nrnr Copyright (C) d+ Multi-Tech Systems, Inc.,nr Multi-Tech Systems, Inc.,nr 2205 Woodale Drive, Mounds View,nr Minnesota 55112, USA.nrnr MultiVOIP Version ([d.]+)nr| p/Multicom voip telnetd/ i/MultiVOIP $1/ d/VoIP adapter/
match telnet m|^xffxfdx01xffxfd!xffxfbx01xffxfbx03rrn*****************************************************rnrrnr Welcome to the WRT54G Shell BoxrnrrnrFirmware version: Wifi-box.net ([d.]+).wfb dd/dd/ddrn| p/Linksys WRT54G with wifi-box.net firmware telnetd/ v/$1/
match telnet m|^xffxfdx03xffxfbx01xffxfbx03EthernetBoard OkiLAN 8100e Ver 01.64 TELNET server.rnrnlogin: | p/OkiLAN 8100e print server telnetd/ v/$1/ d/print server/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18rnnLantronix ETS16 Version V([d.]+)/d+(d+)nrnType HELP at the 'BRTR-ETS16>' prompt for assistance.nrnUsername> | p/Lantronix ETS16 terminal server telnetd/ v/$1/ d/terminal server/
match telnet m|^xffxfbx01xffxfbx03xffxfdx03TELNET session now in ESTABLISHED staternrn(.*) login: | p/Allied Telesyn Rapier switch telnetd/ i/$1/ d/switch/
match telnet m%^xffxfex01rnrn+=++rn| +[ ConnectUPS Web/SNMP Card Configuration Utility ] |rn+=++rnrnEnter Password: % p|ConnectUPS Web/SNMP Card telnetd| d/power-device/
match telnet m|^rnWelcome to slush. (Version ([d.]+))rnrnrnxffxfbx01xffxfbx03([w-_. ]+) login: | p/slush telnetd/ v/$1/ i/$2/ o/TiniOS/
match telnet m|^xffxfbx01nrnrWebRamp 410i login: $| p/WebRamp 410i ISDN router telnetd/ d/router/
match telnet m|^Please Wait...Connection Accepted (TelSrv ([d.]+))rnrnUsername : | p/TelSrc telnetd/ v/$1/ o/Windows/
match telnet m|xffxfbx01xffxfbx03rnINTERMEC 540+/542+ TELNET Print Server V([d.]+) .*rnrnINTERMEC 540+/542+ network login: | p|Intermec 540+/542+ print server telnetd| v/$1/ d/print server/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18x1b[2Jx1b[1;1HConnecting....x1b[2Jx1b[1;1HAdtran - TSU 120ernrnPassword: | p/Adtran TSO 120e telnetd/ d/broadband router/
match telnet m|^xffxfdx1fxffxfdx18xffxfbx01xffxfbx03nWelcome to GoodTech Systems Telnet Server for Windows S+ (Evaluation Copy)nrn(C) Copyright d+-d+ GoodTech Systems, Inc.nrnnLogin username: | p/GoodTech Systems telnetd/ i/Evaluation copy/ o/Windows/
match telnet m|^xffxfdx18xffxfe"xffxfbx03xffxfex01xffxfbx01xffxfax18x01xffxf0xffxfdx1fBytefusion Telnet ([d.]+), Copyright d+-d+ Bytefusion Ltd.nrUnregistered Evaluation. See www.bytefusion.com/telnet.htmlrnnrWIN3 Login: | p/Bytefusion telnetd/ v/$1/ i/Evaluation copy/ o/Windows/
match telnet m|^Windows Telnet Server Version ([d.]+)rnCopyright(C) Jordan Stojanovski d+rn------------------------------------rnUser name: | p/Jordan Stojanovski Windows telnetd/ v/$1/ o/Windows/
match telnet m|^xffxfex01xffxfdx03xffxfdx18xffxfdx1fxffxfdxffxfbx03xffxfbx01xffxfbThis is an unregistered copy of the Ataman TCP Remote Logon Services.rnThe Ataman TCP Remote Logon Services has a d+ day evaluation period.rnThis copy was installed d+ days ago.rnrnAccount Name: | p/Ataman telnetd/ i/Evaluation copy/ o/Windows/
match telnet m=^xffxfbx01xffxfdx1fxffxfbx03x1b[1;1fx1b[37m +x1b[2;1f +x1b[3;1f +x1b[4;1f -+ +x1b[5;1f| KpyM Telnet Server v([d.]+) +|= p/KpyM telnetd/ v/$1/ o/Windows/
match telnet m|^x1b[2Jx1b(0x1b[01;00Hlqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqkx1b| p/3Com Linkswitch telnetd/ d/switch/
match telnet m|^xffxfbx01rnD-link Corp. Access Point login: | p/D-Link DWL access point/ d/router/
match telnet m|^xffxfbx01xffxfdx03xffxfbx03x1b[0mx1b[2Jx1b[0mx1b[2Jx1b[2;66Hx1b[1mx1b[21;1Hx1b[0m-+x1b[22;2Hx1b[0mFunction:x1b[23;2Hx1b[0mMessage:x1b[24;2Hx1b[7mCTRL+R = Refresh +x1b[8;12Hx1b[0mIBM BladeCenter 4-Port Gb Ethernet Switch Module Console| p/IBM BladeCenter 4-Port Gb switch telnetd/ d/switch/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18 x1bcx1b[2Jx1b[1;1HTelnetrnx1b[3;1H CF8720 Olicom Fast Ethernet L3 Switch| p/Olicom CrossFire 8720 switch telnetd/ d/switch/
match telnet m|^xffxfbx01xffxfex01xffxfdx03xffxfbx03x1b[0;1Hx1b[Jx1b[1;1Hx1b[0;1Hx1b[Jx1b[1;1Hx1b[0m =+rn AT-8326GB Management System Version ([d.]+) rn Remote - Telnetrn| p/Allied Telesyn 8326GB switch telnetd/ v/$1/ d/switch/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18rn Welcome to Quidway A8010 Expert Multiservice Access Switchrn| p/Huawei Quidway A8010 remote access telnetd/ d/remote management/
match telnet m|^xffxfbx01xffxfdx03xffxfbx03x1b[0mx1b[2Jx1b[0mx1b[2Jx1b[1;1Hx1b[0m-.*Enter case-sensitive username. No username is assigned by default.|s p/Intel 460T Standalone switch telnetd/ d/switch/
match telnet m|^rnEfficient 5851 SDSL [ATM] Router (5851-d+) v([d-.]+) Readyrnxffxfbx01xffxfbx03xffxfdx01xffxfex01Login: | p/Efficient 5851 DSL router telnetd/ v/$1/ d/router/
match telnet m|^[TS]rn$| p/Teamspeak VoIP Information telnetd/
match telnet m|^xffxfbx01rnr*+nrr* Copyright (c) d+ Nortel Networks, Inc. *nrr* All Rights Reserved +*nrr* Passport 8010 +*nrr* Software Release ([d.]+) | p/Nortel Passport 8010 router telnetd/ v/$1/ d/router/
match telnet m|^Rapture Runtime Environment v([d.]+) -- (c) d+ -- Iron Realms Entertainmentrn| p/Rapture-based MUD telnetd/ v/$1/
match telnet m|^NPC Telnet permit one connection.rn But One connection() already keep alive.rnGood Bye !! rn| p/Samsung printer telnetd/ d/printer/
match telnet m|^nrnr.** MWR Ver ([d.]+) *.*SMAUG|s p/SMAUG MUD server/ v/$1/
match telnet m|^xffxfbx03xffxfbx01x1b[2Jx1b[0;0Hx1b<rn x1b[7m +x1b[0m +rn +x1b[7m +Welcome to Management Blade ([d.]+) | p/BX600 Blade Chassis Manager telnetd/ v/$1/ d/remote management/
match telnet m|^rnrnWelcome to the SoundBridge Shell version ([d.]+) ReleasernType '?' for help or 'help <command>' for help on <command>.rnrnSoundBridge> | p/Roku SoundBridge telnetd/ v/$1/ d/media device/
match telnet m|^xffxfbx01rnWelcome to NetLinx v([d.]+) Copyright AMX Corp. d+-d+rn>| p/AMX NetLinx telnetd/ v/$1/ d/media device/ o/VxWorks/
match telnet m|^xffxfbx01xffxfbx03rnrn[Dell TM 1170 AP 2]> Please enter password: | p/Dell TrueMobile 1170 wireless router telnetd/ d/router/
match telnet m|^rnSiemens d+ T1E1 [COMBO] Router (([d-]+)) v([d.]+) Readyrnxffxfbx01xffxfbx03xffxfdx01xffxfex01Username: | p/Siemens $1 T1E1 router/ v/$2/ d/router/
match telnet m|^xffxfbx03xffxfbx01nrnrnrWelcome to the SIA2410Rnr| p/Net to Net SIA2410R DSL router telnetd/ d/router/
match telnet m|^xffxfbx01Welcome to the DataStage Telnet Server.rrnEnter user name: | p/Ascentia DataStage telnetd/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18xffxfdx1frnReload scheduled for .* (in .*)rnRouter>| p/Cisco 1601R router telnetd/ o/IOS/ d/router/
match telnet m|^xffxfbx01xffxfdx03xffxfbx03Telnet access disabled. Enable in switch CLIrn| p/Aruba Networks AP 61 telnetd/ d/router/
match telnet m|^xffxfbx01xffxfdx01xffxfbx03xffxfdx03xffxfbx05xffxfdx05PointRed Technologies, Inc. PartNo: ([d-]+), Version: ([d.]+)rnrnlogin:| p/PointRed Technologies PartNo $1 telnetd/ v/$1/
match telnet m|^xffxfbx03xffxfbx01nrnr +Copyright (C) d+ MultiTech Software Systems Inc.,nr.*MultiVoIP Version ([d.]+)nr|s p/MultiTech MultiVoIP telnetd/ v/$1/ d/VoIP adapter/
match telnet m=^xffxfbx01xffxfbx03rn ____ _ _ _ _ ____ _rn / _ || || |(_) ___ __| | | _ \ __ _ | |_ __ _rn= p/Allied Data CopperJet router telnetd/ d/router/
match telnet m|^xffxfcx01xffxfbx01xffxfbx03xffxfdx18xffxfbx18xffxfdx1fxffxfbx1fxffxfb"xffxfbx05rnCLI access not allowed until the SCC is active.rnrn| p/Checkpoint firewall telnetd/ d/firewall/
match telnet m|^xffxfbx01 IP PHONE 2 V([d.]+) | p/NG VoIP Phone 2 telnetd/ v/$1/ d/VoIP phone/
# A bit general:
match telnet m|^xffxfbx01n?rnr?VxWorks login: | p/VxWorks telnetd/ o/VxWorks/
match telnet m|^xffxfbx01rn([w-_.]+) wireless login: $| p/Conceptronic C54APT wireless router telnetd/ i/Name $1/ d/router/
match telnet m|^xffxfbx01rnrPassword: $| p|Zyxel Prestige/Efficient Speedstream adsl router telnetd| d/rotuer/
match telnet m|^xffxfbx03xffxfbx01password: $| p/D-Link ADSL router telnetd/ d/router/
match telnet m|^rnxffxfbx01Enter password: $| p/SunSwitch telnetd/ d/switch/
match telnet m|^xffxfbx03xffxfbx01rLogin: $| p/Cisco 3000 series VPN Concentrator telnetd/ d/terminal server/
match telnet m|^xffxfdx01xffxfd!xffxfbx01xffxfbx03rrnw+ login: | p/PXES Linux Thin Client telnetd/ o/Linux/ d/terminal/
match telnet m|^xffxfbx01xffxfbx03xffxfdx01nrlogin: | p/Cayman Gatorbox router telnetd/ d/router/
match telnet m|^xffxfbx01xffxfdx03xffxfbx03(rn)?User: | p/Aruba 5000 switch/ d/switch/
match telnet m|^xffxfbx01xffxfbx03rn(w+) rnUser: | p/Aruba 5000 switch/ d/switch/
match telnet m|^login: xffxfbx01xffxfbx03| p|USR/Sagem router telnetd| d/router/
match telnet m|^xffxfbx01xffxfbx03Password: | p/Telindus router telnetd/ d/router/
match telnet m|^xffxfdx01xffxfd!xffxfbx01xffxfbx03rnBusyBox on dslmodem login: | p/Actiontec DSL router/ d/router/
match telnet m|^xffxfbx01xffxfdx03xffxfbx03xffxfdx1fxffxfdx18| p/BladeCenter or TANDBERG Codec telnetd/
match telnet m|^xffxfdx01xffxfd!xffxfbx01xffxfbx03rnlogin: | p/D-Link DSL router telnetd/ d/router/
match telnet m|^xffxfbx01xffxfbx03rnrn[ORiNOCO AP-2000]> Please enter password: | p/ORiNOCO AP-2000 telnetd/ d/router/
match telnet m|^xffxfdx01xffxfdx1fxffxfd!xffxfbx01xffxfbx03rrn([w-_.]+) login: | p|NASLite-SMB/Sveasoft Alchemy firmware telnetd| h/$1/
match telnet m|^rnAnother telnet session is in progress.rn$| p/HP JetDirect telnetd/ d/printer/
match telnet m|^rnSystem unavailable. Please try later.rn$| p/Cisco CSS telnetd/ d/load balancer/ o/IOS/
match telnet m|^xffxfbx03xffxfax18x01xffxf0$| p/Netgear FVS318 router telnetd/ d/router/
match telnet m|^xffxfbxffxfdxffxfbx01xffxfdx01xffxfbx03xffxfdx03Login Name: | p/HP Remote Lights Out Edition II telnetd/ d/remote management/
match telnet m|^xffxfbx01xffxfe"rn*$| p/Network Systems Group router telnetd/ d/router/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18xffxfdx1frnrnUser Access Verificationrnrnlogin:| p/Cisco 1721 router telnetd/ o/IOS/ d/router/
match telnet m|^xffxfbx03xffxfbx01rn Disconnecting...rnn$| p/HP LaserJet printer telnetd/ d/printer/
match telnet m|^xffxfbx01xffxfbx03x1b[2Jx1b[0;0Hx1b[Kx1b[7mTelnet configuration RELEASE ([d.]+)x1b| p/Pirelli Age UB router telnetd/ v/$1/ d/router/
match telnet m|^Telnet server disabledrn$| p/F5 BigIP load balancer telnetd/ i/telnet disabled/ d/load balancer/
match telnet m|^xffxfdx01xffxfdx1fxffxfd!xffxfbx01xffxfbx03rrn login: | p/Linksys WRT54G router telnetd/ i/Sveasoft firmware/ d/router/
match telnet m|^xffxfdx01xffxfdx1fxffxfd!xffxfbx01xffxfbx03rrn(none) login: | p/BusyBox telnetd/
match telnet m|^xffxfbx01Copyright (C) d+ by Compaq Computer Corp. rnrlogin: | p/Compaq 5450 switch telnetd/ d/switch/
match telnet m|^nrnrTHIS IS A MUD BASED ON.....nrnr ROM Version (.*)n| p/ROM-based MUD/ v/$1/
match telnet m|^rn.*Based(loosely) on CircleMUD ([d.]+)|s p/CircleMUD-based MUD telnetd/ v/$1/
match telnet m|^xffxfbx01xffxfdx01xffxfbx03xffxfdx03xffxfbx01xffxfdx01xffxfbx03xffxfdx03rnrnSelect Access Levelrn===================rn1 - Read-Onlyrn2 - Installerrn3 - Administratorrn| p/BreezeACCESS wireless router telnetd/ d/router/
match telnet m|^x1b[0;37;40mx1b[2Jx1b[0;37;40mx1b[1mx1b[15;22HAT-(w+), version ([d.]+)x1b| p/Allied Telesyn $1 switch telnetd/ v/$1/ d/switch/
match telnet m|^xffxfbx01xffxfex01xffxfdx03xffxfbx03x1b[0;0Hx1b[0Jx1b[0;0Hx1b[0Jx1b[1;28HAT-([w-_.]+) Login Menux1b[5;18HAT-[w-_.]+ Local Management System Version ([d.]+) x1b| p/Allied Telesyn $1 switch telnetd/ v/$2/ d/switch/
match telnet m|^xffxfdx03xffxfbx01x1b[2Jx1b[1;1Hx1b[0mx1b[?3lx1b(0x1b[2;40Hx1b(Bx1b(0x1b[2;28Hx1b(BCSX([w-_.]+) Local Managementx1b[0mx1b(0x1b[5;24Hx1b(BCABLETRON Systems, Incorporatedx1b| p/Cabletron CSX$1 router telnetd/ d/router/
match telnet m|^xffxfbx01xffxfdx01xffxfbx03xffxfdx03xffxfbx05xffxfdx05SpeedStream Telnet Serverrnrnrnlogin: | p/Efficient Networks Speedstream router telnetd/ d/router/
match telnet m=^xffxfbx01xffxfbx03rnrn#rn| LANCOM 821 ADSL/ISDNrn| Ver. ([d.]+) /= p|Lancom 821 DSL/ISDN router telnetd| v/$1/ d/router/
match telnet m|^xffxfbx01nrno data rcvd for version stringnrrecv version id unsuccessfulnrSSH Session task 0xw+: Version Exchange Failednr| p/Cisco Aironet 1200 router telnetd/
match telnet m|^xffxfex01Foxconn VoIP TRIO 3C| p/Foxconn VoIP TRIO 3C telnetd/
match telnet m|^Sorry telnet connections not permitted.n$| p/Aruba router telnetd/ d/router/
match telnet m|^rnSorry, this system is engaged.rn$| p/DirecWay satellite router telnetd/ d/router/
match telnet m|^xffxfdx01xffxfd!xffxfbx01xffxfbx03rnBusyBox on (none) login: | p/BusyBox telnetd/
match telnet m|^xffxfdx01xffxfd!xffxfbx01xffxfbx03rnBusyBox on ([w-_.]+) login: | p/BusyBox telnetd/ h/$1/
match telnet m|^xffxfbx01xffxfdx03xffxfbx03x1b(Bx1b)0x1b[2Jx1b[Hx1b[mx0fx1b[10;32Hx0e x1b[11;32H lqx0fx1b[1mLoginx0ex1b[mqqqqqqqqkx1b[12;32H xx1b[13C xx1b[13;32H mqqqqqqqqqqqqqqjx1b[12;34H| p/Adtran Atlass 500 T1 router telnetd/ d/router/
match telnet m|^xffxfbx01xffxfdx1fHummingbird Ltd., Windows NT, Telnetd ((w+) Version ([d.]+))rnrnlogin: | p/Hummingbird windows telnetd/ v/$2/ h/$1/ o/Windows/
match telnet m|^xffxfbx01xffxfbx03rnUser Access VerificationrnrnPlease Enter Login Name: | p/Foundry FastIron switch telnetd/ d/switch/
match telnet m|^xffxfdx01xffxfd!xffxfbx01xffxfbx03rrnx1b[?3lx1b[2JPlease enter your user name and password!! rnrnLogin:| p/Hawking Technology print server telnetd/ d/print server/
match telnet m|^xffxfbx01rnD-Link Access Point login: | p/D-Link Access Point telnetd/ d/router/
match telnet m|^xffxfdx01xffxfd!xffxfbx01xffxfbx03.*rn([w-_.]+) login: |s p/utelnetd/ h/$1/ o/Unix/
match telnet m|^xffxfbx01Select access level (read, write, administer): | p/ 3Com SuperStack II Switch telnetd/ d/switch/
match telnet m|^xffxfdx01xffxfdx1fxffxfd!xffxfbx01xffxfbx03Login failed.rn| p/Busybox telnetd/
match telnet m|^rnEfficient 5851 SDSL [CM] Router ((5851-d+)) v([d.]+) Readyrnxffxfbx01xffxfbx03xffxfdx01xffxfex01Login: | p/Efficient Networks $1 SDSL router telnetd/ v/$2/ d/router/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18rnnLantronix LPS1 Version V(d[w/-_+.]+)((d+))nrnType HELP at the 'Local_3> ' prompt for assistance.nrnUsername> | p/Lantronix LPS1 telnetd/ v/$1/ i/Released $2/ d/print server/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18rnTA 600Rrnnnruser: | p/Adtran TA 600R router telnetd/ d/router/
match telnet m|^xffxfdx03xffxfbx03xffxfdx01xffxfbx01rnrrnUser Name:$| p/Dell PowerConnect switch telnetd/ d/switch/
match telnet m|^xffxfdx03xffxfbx01xffxfbx03x1b[1;1Hx1b[2Kx1b.*BayStack ([w-_.]+) Main Menux1b|s p/BayStack $1 switch telnetd/ d/switch/
match telnet m|^xffxfbx01xffxfdx03xffxfbx03nr +*+nr +Welcome to ([w-_.]+)nr +*+nrnrD-Link Corp., Inc. Software Release ([w-_.)(/]+)nrCopyright (c) d+-d+ by D-Link Corp., Inc.nrnrlogin: | p/D-Link router telnetd/ v/$2/ i/$1/ d/router/
match telnet m|^xffxfdx01xffxfd!xffxfbx01xffxfbx03# | p/AML M7100 telnetd/
match telnet m|^xffxfbx03xffxfbx01xffxfdx1frnUsing telnet exposes your password. Using ssh is a safer choice.rnrnUsername: | p/Blue Coat telnetd/
match telnet m|^xffxfbx03xffxfbx01xffxfbx03xffxfbx01rnrnPIX passwd: | p/Cisco PIX firewall telnetd/
match telnet m|^TELNET server version ([d.]+) ready at rnrrnpassword: xffxfcx01| p/ASCOM ColtSoho router telnetd/ v/$1/ d/router/
match telnet m|^xffxfbx01rn#-+rn# Tasman Networks Inc. Telnet Loginrn#| p/Tasman Networks router telnetd/ d/router/
match telnet m|^nrnrHi! I am your Net Tamagotchi! I love you!!| p/Net Tamagotchi telnetd/
match telnet m|^xffxfdx03xffxfbx01rnrntt Welcome to P330rnttSW version ([d.]+)rnrnrnLogin: | p/Avaya P330 switch telnetd/ v/$1/ d/switch/
match telnet m|^xffxfbx01xffxfdx01xffxfbx03xffxfdx03xffxfbx05xffxfdx05xffxfdx1fSpeedStream Telnet Serverrnrnrnlogin: | p/SpeedStream router telnetd/ d/router/
match telnet m|^xffxfdx01xffxfdx1fxffxfd!xffxfbx01xffxfbx03rrnrnrwelcome on your dreambox! - Kernel (d[w.]+) ([d:]+).rnr([w-_.]+) login: | p/Dreambox DVB telnetd/ d/media device/ i/Kernel $1/ h/$2/
match telnet m|^xffxfbx01xffxfbx03xffxfdx1frnx1b[34;1m *********************************************** rnx1b[34;1m| p/SAP J2EE engine telnetd/
match telnet m|^xffxfe"xffxfbx01 x1b[Hx1b[Jx1b[3;1HCB-1000 S/N: (d+)x1b[3;56HSymbol Technologies, Inc.x1b[4;1HVersion ([w-_.]+)x1b[4;44HEthernet HW address ([w:]+)x1b[21;1H| p/Symbol CB-1000 bridge telnetd/ v/$2/ i/SN $1; MAC $3/ d/bridge/
match telnet m|^StoneGate firewall ([d.]+) nrSG login: | p/StoneGate firewall telnetd/ d/firewall/
match telnet-proxy m|^nodnsquery/[d.]+ is not authorized to use the telnet proxyrn| p/Gauntlet telnet proxy/
match telnet-proxy m|^Eingabe Servername[:Port] : | p/JanaServer telnet proxy/ i/German/
match telnet-proxy m|^xffxfbx01xffxfbx03Telnet Gateway ready=enter computer name to connect to.\x0d\x0a\xd\xahost[:port]: rn| p/602LAN Suite telnet proxy/ o/Windows/
match telnet-ssl m|^xffxfd.$| p|telnetd-ssl|
# tinc 1.0.2-2 on Linux
match tinc m|^0 w+ 17n| p/tinc vpn daemon/
# This will match systems with clocks set between the
# following 2 dates:
# 0xC4000000 = Mon, 15 Mar 2004 10:12:16 GMT
# 0xCCFFFFFF = Sat, 27 Dec 2008 01:14:39 GMT
# Also needs updating in the UDP Help probe (search for TIME)
# TIME
match time m|^[xc4-xcc]...$| i/32 bits/
match time m|^[xc4-xcc]....$| i/64 bits/
# Tiny Personal Firewall 2.0
match tinyfw m|^x0fnx01x02xc0x0ef7xbbx9bSxfcx86xe4x7fx18xb8x97x06 | p/Tiny Personal Firewall/ v/2.0/
match trackerlink m=^d+|d+|TrackerLINK Ver. ([d.]+)= p/TrackerLINK/ v/$1/
# Kerio Personal Firewall 4.02 on Windows 2000, 4.0.11 on W2K SP4+ too (port 44xxx)
match keriopfservice m|^x12x03x04x02| p/Kerio PF 4 Service/ i/maybe 4.0.2-11/
# Kerio PF 4.0.11 unregistered - GUI process (Port 1027-1200,44xxx? RPC?) on MS W2K SP4+
match keriopfgui m|^x12rx03x02x9ax20xd0Zx1ex1bxa3*xf2xddxe2(xc3sp&xdaxe4YpxdbETxf9x8ccxc24*Yxbexb3xbaxd6%xf5xb668xadxab>@D<x01<ix80O>xdd>)xdbx18xf55xd1xbax96x1cx17x17x01x01| p/Kerio PF 4 GUI/ i/maybe 4.0.11/
# Kerio Personal Firewall 2.1.4 on Windows
# Tiny Personal Firewall 2.0
# Kerio Personal Firewall, Firewall engine version 2.1.5 Driver version 3.0.0 on WinXP
match tinyfw m|^x0fnx01x02| p/Kerio Personal Firewall/ v/2.1.X/ i/or Tiny Personal Firewall/
match ssl/vmware-auth m|^220 VMware Authentication Daemon Version (d[-.w]+): SSL Requiredrn| p/VMware Authentication Daemon/ v/$1/
match ssl/vmware-auth m|^220 VMware Authentication Daemon Version (d[-.w]+): SSL Required, MKSDisplayProtocol:VNC rn| p/VMware GSX Authentication Daemon/ v/$1/
match vnc m|^RFB 003.00(d)n$| p/VNC/ i/protocol 3.$1/
match vnc m|^RFB 003.00(d)nx1aToo many security failures$| p/VNC/ i/protocol 3.$1; Locked out/
match vnc m|^RFB 003.130n$| p/VNC/ i/unofficial protocol 3.130/
match vnc m|^RFB 003.88[89]n$| p/Apple remote desktop vnc/ o/Mac OS X/
match vnc m|^RFB 000.000n$| p/Ultr@VNC Repeater/
match vtun m|^VTUN server ver +(d[-.w /]+)n| p/Vtun Virtual Tunnel/ v/$1/
match vtun m|^VTUN server ver . (d[-.w /]+)n| p/Vtun Virtual Tunnel/ v/$1/
match vtun m|^VTUN server ver (.*) (d[-.w /]+)n| p/Vtun Virtual Tunnel/ v/$1/
match weather m|^TrueWeatherrnrn>| p/TrueWeather Desktop Weather Authority server/
# http://www.3w.net/lan/faq.html
match websense-eim m|^x96xfeSxab$| p/Websense EIM/
match winshell m/^Microsoft Windows ((2000)|(XP)|(NT 4.0)) [Version ([d.]+)]rn(C) Copyright 1985-20dd Microsoft Corp.rnrn/ p/Microsoft Windows $1 $5 cmd.exe/ o/Windows/
# CcXstream Media Server 1.0.15 on Linux - Uses XBMSP (X-Box Media Streaming Protocol)
match xbmsp m|^XBMSP-1.0 1.0 CcXstream Media Server (d[-.w]+)n| p/CcXstream Media Server/ v/$1/
match xbmsp m|^XBMSP-1.0 1.0 Media File XStream Server n| p/Media File XStream/
match xinetd m=^([w-_.]+ (tcp|udp) d{1,5}n)+= p/xinetd service display/ o/Unix/
# XFCE Desktop Version 3.99.4 From Gentoo 1.4 Ebuild on Linux 2.4.6
match xfce-session m|^x01.$| p/XFCE Session Manager/
match xmailctl m|^+d+ <[d.]+@[d.]+> XMail ([d.]+) (Linux/Ix86) CTRL Server; .*rn| p/XMail CTRL Server/ v/$1/ o/Linux/
match xmailctl m|^+d+ <[d.]+@[d.]+> XMail ([d.]+) CTRL Server; .*rn| p/XMail CTRL Server/ v/$1/
match xmbmon m|^TEMP0 : [d.]+nTEMP1 : [d.]+nTEMP2 : [d.]+nFAN0 : [d.]+nFAN1 : [d.]+nFAN2 : [d.]+n| p/Mother Board Monitor/
match zebra m|^rnHello, this is zebra (version (d[-.w]+)).rnCopyright 1996-20| p/GNU Zebra routing software/ v/$1/
match zebra m|^rnHello, this is zebra (version (d[-.w]+)).rnCopyright 200d| p/GNU Zebra routing software/ v/$1/
match zebra m|^Vty password is not set.rn$| p/Quagga routing software/
match zebra m|^rnUser Access Verificationrnrnxffxfbx01xffxfbx03xffxfe"xffxfdx1fPassword: | p/GNU Zebra routing software/
match pcp m|^x14p..x02x01| p/SGI Performance Co-Pilot/
match smtp m|^220 SPAM, we hates it.rn| p/Barracuda Spam firewall/
# 13720/tcp
match bprd m|^.EXIT STATUS d+$| p/Veritas Netbackup/
match bprd m|^request daemon can't accept sessionsnanother instance may already be running.nAddress already in usen$| p/Veritas Netbackup/
match bprd m|^bp[w-]+: error while loading shared libraries: libstdc++-libc6.2-2.so.3: cannot open shared object file: No such file or directoryn$| p/Veritas Netbackup/ i/Misconfigured/
# 13782/tcp
match bpcd m|^gethostbyaddr: [w ]+n$| p/Veritas Netbackup/ i/refused/
# PostCast SMTP server 2.6.0 ( http://www.postcastserver.com/ )
match smtp m|^220 PostCast SMTP server.*rn$| p/PostCast SMTP server/
match omapi m|^dx18$| p/ISC (BIND|DHCPD) OMAPI/
match openvpn m|^x0e@........x0e@| p/OpenVPN/
match openvpn m|^*@n.**@n|s p/OpenVPN/
match osiris m|^x80[=+:]x01x03x01.x10|s p/osiris host IDS agent/
match svnserve m|^( success ( d d ( ANONYMOUS ) ( | p/Subversion/
match icecreamd m|^[x14-x1f]$| p/icecreamd/
match apc-agent m|^xacxedx05$| p/APC PowerChute agent/ d/power-device/
# OpenH323 Gatekeeper 2.0.3
match afs3-fileserver m|^xffxfdx03xffxfbx05Version:rnGatekeeper(GNU) Version(([d.]+)) Ext(.*) Build(.*) Sys(Linux .*)rnrn| p/OpenH323 Gatekeeper/ v/$1/ o/Linux/
match wingate-control m|^.x01.[x02x03]x01d+$| p/WinGate Administration/ o/Windows/
# Wingate redir: Probably not general enough
match wingate m|^nx02x01$| p/WinGate transparent redirection/ o/Windows/
match mail-admin m|^OK0100 eXtremail V([d.]+) release (d+) REMote management ...rn| p/eXtremail remote management/ v/$1 release $2/
match pppd m|^SuSE Meta pppd (smpppd), Version ([d.]+)rn| p/SuSE Meta pppd/ v/$1/ o/Linux/
match pppctl m|^PPP on ([w-_.]+)> | p/pppctld/ h/$1/
match honeypot m|^503 Service Unavailablernrn$| p/Network Flight Recorder BackOfficer Friendly honeypot/
match honeypot m|^rnlogin: $| p/Network Flight Recorder BackOfficer Friendly telnet honeypot/
match honeypot m|^rn[w-_.]+ [d.]+ - Unauthorized access x07prohibited under penalty of law.rnrnlogin: xffxfcx01| p/Whiz Kid Technomagic Imaginary telnet honeypot/ o/Windows/
match honeypot m|^Microsoft Windows XP [Version [d.]+]n(C) Copyright 1985-d+ Microsoft Corp.nnC:\>| p/honeyd cmdexe.pl/
match tunnelvision m|^HELLO Welcome to Tunnel Vision (([d.]+))n| p/Tunnel Vision VPN info/ v/$1/
match domain m|^x80xf0x80x12x01x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA!x01| p/Microsoft DNS/ o/Windows/
##############################NEXT PROBE##############################
Probe TCP GenericLines q|rnrn|
rarity 1
ports 21,23,35,43,79,98,110,113,119,199,214,264,449,505,510,540,587,616,628,666,731,1000,1040-1043,1080,1212,1220,1248,1302,1400,1432,1467,1501,1666,2010,2024,2600,3000,3005,3128,3310,3333,3940,5000,5400,5432,5555,5570,6112,6667-6670,7144,7145,7780,8000,8138,9801,11371,11965,11211,13720,15000,19150,26214,26470,31416,30444,56667
match abc m|^FeedbacknError=You need unique ID to command ABC!| p/ABC Torrent http interface/
match antivir m|^x80$| p/drweb anti-virus/
match as-servermap m|^-$| p|IBM OS/400 as-servermapd| d|OS/400|
match biff m|^Message receivedn$| p/NotifyMail biffd/
match biff m|^Use of uninitialized value in transliteration (tr///) at /var/jchkmail/user-filter| p/Joe's j-chkmail biffd/
match bitdefender-ctl m|^(null) 500 Internal Errorn(null) 500 Internal Errorn$| p/Bitdefender Remote Admin Console/
# bnetd (PvPGN BnetD Mod version 1.5.0) on Debian GNU/Linux (sid)
match bnetd m|^BOT or Telnet Connection from [[d.]+]rnrnEnter your account name and password.rnSorry, there is no guest account.rnrnUsername: | p/PvPGN BnetD Mod/ v/1.5.0/
# bnetd server 0.4.25 on Linux
match bnetd m|^Username: $| p/bnetd open source Blizzard Battlenet server/
match boinc m|^<unrecognized/>nx03$| p/Boinc GUI RPC port/
match boinc m|^<error>unrecognized op</error/>nx03$| p/Boinc GUI RPC port/
match boinc m|^<boinc_gui_rpc_reply>n<client_version>(d+)</client_version>n<error>unrecognized op</error>n</boinc_gui_rpc_reply>n| p/Boinc GUI RPC port/ v/$1/
match boinc m|^<boinc_gui_rpc_reply>n<major_version>(d+)</major_version>n<minor_version>(d+)</minor_version>n<release>(d+)</release>| p/Boinc GUI RPC port/ v/$1.$2.$3/
# Cisco PIX 501 running PIX IOS 6.3(1)
match ciscopsdm m|^xc0x01....x03| p/Cisco PIX Secure Database Manager/ d/firewall/ o/IOS/
match crossmatchverifier m|^Idlern$| p/Cross Match Technologies Verifier fingerprint capture control port/
match clamd m|^UNKNOWN COMMANDn$| p/Clam AV/
match datamaxdb m|^X01rnX01rn$| p/MailMax DataMaxDB/ o/Windows/
match dusk m|^x03Not a valid name. This may because you left it blank or used invalid symbols. Please try again.n| p/Dusk Java-based game/
# I think this type of eggdrop banner is only used when customized or such.
match eggdrop m|^rnNickname.rnSorry, that nickname format is invalid.rn$| p/Eggdrop irc bot console/
match eggdrop m|^rnSurnom.rnSorry, that nickname format is invalid.rn$| p/Eggdrop irc bot console/ i/French/
match finger m|^Gathering system data...nUsername Real name Idletime TTY Remote console locationn| p/Cfingerd/
match finger m|^Punix version ([d./()]+) - Current Time (since boot) d+:dd:ddrnName pid stat pc cpusec stack pr/sy idle ttyrn| p/Lantronix ETS16 fingerd/ i/Punix $1/ d/terminal server/ o/Punix/
match finger m|^Finger online user list request denied.rn| p/SLMail fingerd/ o/Windows/
match finger m|^Username Real name Idletime TTY Remote console locationn| p/Configurable Finger-Query Daemon/ o/Unix/
match finger m|^Login Name Tty Idle Login Time Office Office Phonern| p/Debian fingerd/ o/Linux/
match finger m|^rnIntegrated portrnPrinter Type: Dell Laser Printer ([w-+.]+)rnPrint Job Status: (.*)rn| p/Dell Laser Printer $1 fingerd/ i/Status: $2/ d/printer/
match finger m|^This is finger serverrnrnPlease use username@domain format.rn| p/ArGoSoft Mail fingerd/ o/Windows/
match finger m|^This is ([w-_.]+) finger server.rnrnPlease use username@domain format.rn| p/ArGoSoft Mail fingerd/ h/$1/ o/Windows/
match finger m|^rnIntegrated portrnPrinter Type: Lexmark Optra ([w-.]+)rn| p/Lexmark Optra $1 fingerd/ d/printer/
match netbackup m|^xeaxddxbexefx05x000x000..x08affsprng$| p/Veritas Netbackup Professional/
# Alcatel Speedtouch ADSL Router
match ftp m|^220 Inactivity timer = d+ seconds. Use 'site idle <secs>' to change.rn221 Goodbye (badly formated command seen). You uploaded 0 and downloaded 0 kbytes.rn221 Goodbye (badly formated command seen). You uploaded 0 and downloaded 0 kbytes.rn$| p/Alcatel Speedtouch aDSL router ftpd/ d/broadband router/
# bftpd 1.0.22 on Linux 2.4
match ftp m|^220 rn500 Unknown command: ""rn500 Unknown command: ""rn$| p/bftpd/
# Multitech MultiVoip 410 VoIP gateway
match ftp m|^220 Service readyrn500 Unsupported commandrn$| p/Multitech MultiVoip 410 VoIP gateway ftpd/ d/VoIP adapter/
# NetportExpress PRO/100 3 port print server
match ftp m|^220 FTP server ready.rn530 access denied.rn| p/Intel NetportExpress print server ftpd/ d/print server/
# D-Link Print Server internal FTP daemon (Firmware version 1.38) - D-Link Print Server DP-101
match ftp m|^220 FTP server ready.rn501 Command not supported.rn$| p/D-Link Printer Server ftpd/ d/print server/
match ftp m|^220 ([-.w]+) FTP server ready.rn530 Please login with USER and PASS.rn530 Please login with USER and PASS.rn$| p/Solaris ftpd/ h/$1/ o/Solaris/
# vsftpd (Very Secure FTP Daemon) 1.0.0 on linux with custom ftpd_banner
# We'll have to see if this match is unique enough ... no, it is not enough
match ftp m|^220 .*rn530 Please login with USER and PASS.rn530 Please login with USER and PASS.rn|s p/vsftpd or WU-FTPD/
match ftp m|^220 ([-.w]+) FTP Server ready ...rn530 r : User not logged in. Please login with USER and PASS first.rn530 r : User not logged in. Please login with USER and PASS first.rn$| p/Bulletproof ftp server/ o/Windows/ h/$1/
# BulletProof FTP 2.21 on Windows 2000 Server
match ftp m|^220 ftprn$| p/Bulletproof ftp server/ o/Windows/
match ftp m|^220 FTP server ready.rn200 NOOP command successful.rn| p/Tektronix Phaser ftpd/ d/printer/
match ftp m|^220 "Welcome to Bot FTP service."rn331 Please specify the password.rn230 Login successful. Have fun.rn| p/Unknown trojan ftpd/
match ftp m|^220 OKn226 OKn| p/Sasser worm minimal ftpd/ o/Windows/
match ftp m|^220 FTPd ([d.]+)rn500 Bad commandrn| p/USR8022 router ftpd/ v/$1/ d/router/
match ftp m|^220 Telindus FTP server ready.rn502 Command not implemented.rn502 Command not implemented.rn| p/Telindus ftpd/ d/router/
match ftp m|^220 Server readyrn500 'r': command not understood.rn500 'r': command not understood.rn| p/Welltech Wellgate VoIP adapter ftpd/ d/VoIP adapter/
match ftp m|^220 muddleftpd (([d.]+)) server ready. Enter Username.rn500 Only one command at a time.rn| p/Muddleftpd/ v/$1/
match ftp m|^220 .*rn500 Only one command at a time.rn| p/Muddleftpd/
match fw1-topo m|^Q$| p/Checkpoint FW-1 Topology download/ d/firewall/
# GKrellM System Monitor 2.1.15 on Linux
match gkrellm m|^<error>nBad connect string!| p/GKrellM System Monitor/
match halfd m|^{type INIT} {up d+} {auth d+} {name {([^}]+)}} {ip [d.]+} {max d+} {port (d+)}rn| p/halfd Half-Life admin/ i/Name $1; HL port $2/
match hpssd m|^msg=messageerrornresult-code=5n| p/HP Services and Status Daemon/ o/Linux/
# Some web servers don't give a 'Server: ' line for the Get request, but do for this probe.
match http m|^HTTP/1.1 400 .*rnServer: Microsoft-IIS/(d[-.w]+)rn| p/Microsoft IIS webserver/ v/$1/ o/Windows/
# Icecast version: 1.9+2.0alphasn
match http m|^HTTP/1.0 401 Authentication RequiredrnWWW-Authenticate: Basic realm="Icecast2 Server"rnrnYou need to authenticatern| p/Icecast streaming media server/
# Network Flight Recorder v3.2 on Solaris 8 (sparc)
match http m|^HTTP/1.0 400 Bad requestrnrn$| p/Network Flight Recorder IDS/
# Cisco 350 Series 802.11 AP
match http m|^HTTP/1.0 400 Bad RequestrnServer: thttpd/(d[-.w ]+)rn| p/thttpd/ v/$1/ d/WAP/
# OpenPGP Public Key Server 0.9.6
match http m|^HTTP/1.0 400 Bad RequestrnServer: pks_www/([w-+.]+)rnContent-type: text/htmlrnrn<HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY></BODY>rn| p/OpenPGP Public Key Server/ v/$1/
match http m|^HTTP/1.1 401 UnauthorizedrnConnection: closernContent-Length: d+rnContent-Type: text/htmlrnWWW-Authenticate: Basic realm="osiris"rn| p/osiris host IDS web interface/
match http m|^HTTP/1.1 501 Not ImplementedrnCache-Control: no-cache, must-revalidate, max-age=0rnContent-Type: text/html; charset=UTF-8rnContent-Length: d+rnConnection: closernrn<html><body><h1>Not Implemented</h1>Whatever the heck you just requested, I can't generate.</body></html>| p/darkstat network analyzer httpd/ o/Unix/
match http m|^xffxf0 400 Bad Requestrnrn<HEAD><TITLE>400 Bad Request</TITLE></END>rn<BODY><H1>400 Bad Request</H1></BODY>| p/HP JetDirect printer embedded httpd/ d/printer/
match http m|^HTTP/1.0 400 Bad Requestrn.*This is a WebSEAL error message template file.|s p/Tivoli Access Manager WebSEAL httpd/
match http m|^UNKNOWN 400 Bad RequestrnServer: thttpd/([d.]+) w+rn| p/thttpd/ v/$1/
match http m|^HTTP/1.1 ddd .*rnServer: UnrealEngine UWeb Web Server Build (d+)rn|s p/Unreal Tournament http admin/ v/Build $1/
match http m|^HTTP/1.0 405 Method Not AllowedrnAllow: GET, HEADrnrn405 Method Not Allowedrnrn| p|D-Link printer/webcam http config|
match http m|^HTTP/1.0 400 Bad RequestrnServer: WDaemon/([d.]+)rn| p/World Client WDaemon httpd/ v/$1/ o/Windows/
match http m|^HTTP/1.0 ddd .*nAccept: text/htmlnConnection: closenn<html>n<body text=#FFFFFF bgcolor=#000000>n<center><b><hr height=4 width=400 color=#FF0000>n<font size=5>PunkBuster Server WebTool for ([w-_.]+)</font>| p/PunkBuster web admin/ i/Game: $1/
match http m|^HTTP/1.0 400 Bad RequestrnServer: MpSconServer/([d.]+)rn| p/ZebraNet print server MpSconServer httpd/ v/$1/ d/print server/
match http m|^HTTP/1.1 ddd .*rnrn.*var l1="([^"]+)"n.*document.write("D-Link DI-"+l1)|s p/D-Link DI-$1 router http config/ d/router/
match http m|^HTTP/1.0 400 bad http requestrndate: .*rnserver: SAP Web Application Serverrn| p/SAP Web Application Server/
match http m|^HTTP/1.0 200 OKrnContent-type: text/html; charset=UTF-8rnPragma: no-cachernWindow-target: _toprn| p/Symantec AntiVirus Scan Engine http config/
match http m|^HTTP/1.0 400 Bad RequestrnServer: QTSS ([d.]+) Admin Server/([d.]+)rn| p/QTSS Admin Server httpd/ v/$2/ i/QTSS $1/
match http m|^HTTP/1.0 400 Bad Request 2rnContent-Type: text/htmlrnrn<body><h1>HTTP/1.0 400 Bad Request 2</h1></body>rn$| p/WatchGuard Firebox http config/ d/firewall/
match http m|^HTTP/1.0 400 Bad RequestrnContent-Type: text/htmlrnrn<title>400 Bad Request</title><body>400 Bad Request</body>$| p|Generic router http config| d/router/
match http m|^HTTP/1.1 ddd .*nWWW-Authenticate: Basic realm="Anti-Spam SMTP Proxy (ASSP) Configuration"nContent-type: text/htmlnn<html><body><h1>Unauthorized</h1>n</body></html>n| p/ASSP Anti-Spam Proxy http config/
match icecast m|^HTTP/1.0 200 OKrnServer: icecast/(d[-.w]+)rn| p|Shoutcast/Icecast streaming audio| v|$1|
# slident 0.0.19
match ident m|^0, 0: ERROR: UNKNOWN-ERRORn$| p/slident/
# mlidentd 1.1 on Linux
match ident m|^0,0:ERROR:UNKNOWN-ERRORrn$| p/mlidentd/
# OpenBSD 3.2 identd
# May apply to Linux too -- need to investigate further.
match ident m|^0 , 0 : ERROR : UNKNOWN-ERRORrn$| p/OpenBSD identd/ o/OpenBSD/
# FreeBSD 4.8-RC inetd internal identd
match ident m|^0 , 0 : ERROR : INVALID-PORTrn$| p/FreeBSD identd/ o/FreeBSD/
# pidentd-3.1a19-157
match ident m|^ : ERROR : UNKNOWN-ERRORrn$| p/pidentd/
match ident m|^0, 0 : ERROR : X-INVALID-REQUESTrn$| p/Minidentd/
# http://packages.debian.org/unstable/net/ident2.html
match ident m|^0 , 0 : ERROR : INVALID-PORTrn0 , 0 : ERROR : INVALID-PORTrn$| p/Ident2/
# midentd 2.3.1 on Linux
match ident m|^0, 0 : ERROR : INVALID-PORTrn| p/midentd/
#midentd 2.1 on Linux 2.4.21
match ident m|^0,0 : ERROR : INVALID-PORTrn| p/midentd/
# authd 1.4.3 on Linux
match ident m|^0 , 0 : ERROR :INVALID-PORTrn| p/authd/
match ident m|^: USERID : UNIX : CacheFlow Serverrn| p/CacheFlow identd/ o/CacheOS/
match ident m|^:USERID:OTHER:d+-ident-is-a-completely-pointless-protocol-that-offers-no-security-or-traceability-at-all-so-take-this-and-log-it!rn| p/Fake identd/
match ident m|^ : USERID : UNIX : ([w-_]+)$| p/Klient identd/ i/IRC Nick $1/
match ident m|^rn: ERROR : HIDDEN-USERrn$| p/Borderware Firewall identd/ d/firewall/
match ident m|^ : USERID : UNIX : [a-z]{4,8}rn$| p/Windows XP identd/ o/Windows/
match ident m|^1 , 1 : USERID : OTHER : chuck-the-bsd-deamonrn$| p/widentd/
match imond m|^ERR password requiredrnERR password requiredrn| p/imond fli4l router config/ d/router/
match imond m|^ERR administrator password requiredrnERR administrator password requiredrn$| p/imond fli4l router config/ d/router/
match imond m|^ERRrnERRrn$| p/imond fli4l router config/ d/router/
# Broken inetd configuration
# <27>Dec 19 17:37:37 inetd[28433]: execv /usr/openv/netbackup/bin/bpjava-msvc: No such file or directory
match inetd m|^<d+>[A-Z][a-z][a-z] +d+ d+:d+:d+ inetd[d+]: execv (/[-.\/w]+): (w[s-w.,]+)$| p/inetd/ i/failed to exec $1: $2/
# Diverse IRC bot
match ircbot m|^ rnSorry, that nickname format is invalid.rrn$| p/Diverse IRC bot/
match irc m|^:([w-_.]+) 421 rnrn :rnrn unimplemented protocol requestrn:[w-_.]+ 421 rnrn :rnrn unimplemented protocol requestrn| p/Crackalaka ircd/ h/$1/
match irrd m|^% No search key specifiednn| p/Merit Internet Routing Registry/
match memcache m|^ERRORrnERRORrn$| p/memcached/
match lexlmd m|^.x08|s p/Lexmark language monitor/
# Part of Linux net-snmp-5.0.6-17
match linuxconf m|^500 access denied: Check networking/linuxconf network accessrn$| p/Linuxconf/ i/Access denied/ o/Linux/
# Linuxconf 1.26r4
match linuxconf m|^500 access denied: Check config/networking/misc/linuxconf network accessrn<p>rnBy default,| p/Linuxconf/ i/Access denied/
# Netsaint Status Daemon 2.15
match netsaint m|^Unknown commandn$| p/Netsaint Status Daemon/
match netsaint m|^ERROR No function requested from client.| p/Nagios Statd Server/
# NSClient - http://nsclient.ready2run.nl/
match nsclient m|^ERROR:Wrong password$| p/Netsaint Windows Client/
match omniback m|^HP OpenView OmniBack II ([-.w]+): INET, | p/HP OpenView OmniBack/ v/$1/
match peercast m|^OK2rnicy-caps:d+rnrnOKrn$| p/Peercast/
# Mercury/32 3.32 PH Server module on Windows XP
match ph-addressbook m|^598::Command not recognized.rn598::Command not recognized.rn$| p|Mercury/32 PH addressbook server| o|Windows|
match pop3 m|^+OK POP3 ([-.+w]+) v(d[-.w]+) server readyrn| p/ipop3d/ h/$1/ v/$2/
match pop3 m|^+OK POP3 [([-.+w]+)] (d[-.w]+) server readyrn| p/ipop3d/ h/$1/ v/$2/
# iopd 2003debian0.0304182231-1
match pop3 m|^+OK POP3 [([-.w]+)] v(200[-.w]+) server readyrn-ERR Null commandrn-ERR Null commandrn| p/ipopd/ h/$1/ v/$2/
# Solid POP3d 0.15
match pop3 m|^+OK Solid POP3 server readyrn-ERR unknown commandrn-ERR unknown commandrn$| p/Solid POP3d/
# OS 400 V4R4M0
match pop3 m|^+OK POP3 server readyrn-ERR invalid commandrn$| p/IBM OS 400 pop3d/ o|OS/400|
# mailgate v3.5.177 on Win2K
match pop3 m|^+OK pop server readyrn$| p/MailGate pop3d/ o/Windows/
match pop3 m|^+OK POP3 server ready <[w-]+>rn-ERR Invalid commandrn$| p/SmarterMail pop3d/ o/Windows/
# Perdition
match pop3-proxy m|^+OK POP3 Ready ([w-_.]+) w+rn-ERR Null command, matern| p/Perdition pop3 proxy/ h/$1/
# Postgres 7.1.3
match postgresql m|^EInvalid packet length$| p/PostgreSQL DB/
# postgresql-7.2.3-5.73; linux 2.4.20-18.7 redhat 7.3
match postgresql m|^EFATAL 1: invalid length of startup packetn| p/PostgreSQL DB/
match postgresql m|^EFATAL: ungxfcltige Lxe4nge des Startpaketsn| p/PostgreSQL DB/ i/German/
match priv-print m|^xc0x12Data field missing$| p/AXIS 560 print server/ d/print server/
# Postfix qmqpd on Linux 2.4
match qmqp m|^58:Dnetstring format error while receiving QMQP packet header,$| p/Postfix qmqpd/ i/Quick Mail Queueing Protocol/
# Ximian Red Carpet Daemon 1.4.4 on RedHat Linux 9.0
match redcarpet m|^Status: 400 Bad RequestrnContent-Length: 0rnrn| p/Ximian Red Carpet Daemon/
match sdcomm m|^ERR 27$| p/RSA SecureID Ace Server/
match socks m|^[rn...$| p/Socks4/
match socks m|^x05x01x01$| p/Socks5/
match solfe m|^x02x01xfbxffxfbxffxffxffxffxffNOSUP| p/HP PNM Solid FlowEngine/
# Giving some problems:
#match stickynote m|^x01$| p/StickyNote windows freeware/ o/Windows/
match sstp m|^SSTP/([d.]+) 400 Bad Requestrnrn$| p/Sakura Script Transfer Protocol/ i/Protocol $1/
match smux m|^Ax01x02$| p/Linux SNMP multiplexer/ o/Linux/
# This could go into the null probe, but the problem is that it is a prefix
# of what other routers (at least HP JetDirect printer telentd) send.
# And at least the JD sends the string below first, before it send the
# rest in other packets. So it is best to capture this one here in
# GenericLines.
match telnet m|^xffxfbx03xffxfbx01$| p/Nokia M1112 router telnetd/ d/router/
# Solaris 9
match uucp m|^login: Please enter user name: Password: $| p/Solaris uucpd/ o/Solaris/
# SunOS 4
match uucp m|^login: Password: Login incorrect.$| p/SunOS uucpd/ o/SunOS/
match ups m|^32r $| p/Cyber Power PowerPanelPlus UPS Server/ o/Windows/
match whois m|^% No entries found for the selected source(s).n$| p/Merit IRRD whoisd/
match whois m|^Process query: ''nQuery recognized as IP.nQuerying ([wd-_.]+):(d+) with whois.nn| p/gwhois/ i/Uses $1:$2/
match whois m|^Process query: ''nQuery recognized as IP.n| p/gwhois/
match wincomm m|^128 System Incompatible Windows Communicator client or server versionrn128 System Incompatible Windows Communicator client or server versionrn| p/Windows Communicator/
match zebedee m|^x02x01$| p/Zebedee encrypted tunnel/
match bmc-perform-service m|^SDPACK$| p/BMC Perform Service Daemon/
# Grisoft AVG antivirus server (distributing virus database updates)
match http m|HTTP/1.0 ddd [w ]+rnServer: GRISOFT-AVG TCP Server/(d[-.w]+) .*rn| p/Grisoft AVG TCP Server/ v/$1/
# Ubicom embedded ( http://www.ubicom.com/home.htm )
match http m|^HTTP/1.1 400 Bad RequestrnCache-control: no-cachernServer: Ubicom/(d[-.w ]+)rn| p/Ubicom embedded HTTP server/ v/$1/
match http m|^<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">n<html>n<head>n<title>GoodTech Systems Telnet Server Administration Login</title>n| p/GoodTech Systems telnet server web admin/ o/Windows/
match nntp m|^200 Coruscant BBS News (Synchronet NNTP Service v(d[-.w ]+))rn| p/Synchronet NNTP Service/ v/$1/
# wesnotd multiplayer network daemon (http://www.wesnoth.org/)
match wesnotd m|^x16x1fx02versionx040....x02mustloginx05x01| p/wesnotd/
match telnet m|^xffxfbx01nrSSH service name not present in rcvd msgnrSSH Session task 0xw+: Version Exchange FailednrnrnrSSH service name not present in rcvd msgnr| p/Cisco 350 Series AP telnetd/ d/router/
match telnet m|^xffxfe"xffxfbx01xffxfbx03User : rnr?SpeedTouch (([w-]+))rnr?Password : Invalid Passwordrnr?Closing connectionrn| p/Alcatel SpeedTouch DSL router/ i/MAC $1/ d/router/
match telnet m|^xffxfex01xffxfdx03xffxfdx18xffxfdx1fxffxfbx03xffxfbx01rnAccount Name: rnPassword: rnThis copy of the Ataman Telnetd Server is registered as licensed to:rnt(.+)rnrnLogin failed: unknown user name, password or privilege incorrect.rn| p/Ataman telnetd/ i/Registerd to $1/ o/Windows/
match telnet m|^Password:xffxfbx01nrTry again, you polio:nnrTry again, you polio:n| p/VLC Player telnetd/
match telnet m=^xffxfbx01xffxfbx03rnrnrn +-+rn +| Cyclades-PR4000: CyROS V_([d.]+) (.*) |rn= p/Cyclades PR4000 router telnetd/ d/router/
match telnet m|^xffxfbx01xffxfbx03rnrnLogin: rnrnYou must supply a usernamernrnLogin: rnrnYou must supply a usernamernrnLogin: | p/Billion 741GE ADSL router telnetd/ d/router/
# Not sure if this is really a telnet service but many people reported it running on port23:
match telnet m|^xffxfbx01$| p/SMC SMC2870W Wireless Ethernet Bridge/ d/bridge/
match telnet m|^rnrnThis is a FirstClass system, from Open Text Corporation.rnrnrnFirstClass is an e-mail and conferencing system with a graphical user interface.rnrnrnThe Command Line Interface is not available on this sy| p/FirstClass telnetd/ i/CLI disabled/
match telnet m|^xffxfbx01rnPassword:rnLogged in as guestrn| p/Linkstar Comsat router telnetd/ d/router/
match telnet m|^xffxfbx01Login: rnLogin: rnLogin: | p/Lingo VoIP config telnetd/ d/VoIP adapter/
match telnet m|^xffxfbx01xffxfbx03xffxfdx18xffxfdx1frnuser: rnpassword: rnrnuser: | p/KIRK Wireless Server 600 telnetd/ d/VoIP adapter/
match telnet m|^xffxfbx01nr-> nr-> nr-> | p/Coresma Phazer Docsis USB cable modem telnetd/ d/router/
match telnet m|^bad passwordrn$| p/Cybersitter CLI/
match telnet m|^xffxfd"xffxfbx01SSE version ([d.]+)rnCopyright [d, ]+ by MotorolarnUsername:| p/Motorola Canopy telnetd/ i/SSE $1/ d/telecom-misc/
match telnet m|^xffxfbx01xffxfbx03rnrn[ORiNOCO-AP-[w-]+]> Please enter password: rnIncorrect Passwordrnrn[ORiNOCO-AP-[w-]+]> Please enter password: rn| p/ORiNOCO wireless router telnetd/ d/router/
match telnet m|^xffxfbx01Password? rn500 Configuration error. Disconnecting!n| p/Tru64 UNIX gated/ o/Tru64 UNIX/
match telnet m|^xffxfbx01rnrnlogin: rnrnrrnpassword: $| p/Welltech Wellgate VoIP adapter telnetd/ d/VoIP adapter/
match telnet m|^xffxfbx03xffxfbx01xffxfbx1fxffxfdx18Avocent CPS-810 S/W Version ([d.]+)rnUsername: rnPassword: rnInvalid LoginrnUsername: | p/Avocent CPS-810 serial port server telnetd/ v/$1/ d/specialized/
match telnet m|^xffxfbx01xffxfbx03nGestetner Maintenance Shell. nrUser access verification.nrPassword:| p/Gestetner DSm622 maintenance telnetd/ d/printer/
match telnet m|^xffxfbx01xffxfbx03nNRG Maintenance Shell. nrUser access verification.nrPassword:| p/NRG maintenance telnetd/ d/printer/
match transbase m|^+x04@TransBase Multiplexer error report:nIllegal request| p/Transbase Database/
match remoting m|^.NETx01x02x02x03x01x03x01x01hServer encountered an internal error. To get more info turn on customErrors in the server's config file.x05| p/MS .NET Remoting services/
match bitkeeper m|^ERROR-Try helpnERROR-Try helpn$| p/Bitkeeper/
match webcache m|^HTTP/1.0 400 Bad RequestrnExpires: .*rnContent-Type: text/htmlrnrn<html>n<head><title>Bad formed request or url</title>n| p/webcache/
# Novell ZENworks for Desktops Imaging Proxy 4.01.03
# Not sure if this is netware specific (linux too?) -Doug
match zenimaging m|^xffxffxfb&$| p/Novell ZENworks Imaging Proxy/
match ajp12 m|^Status: 400 Bad RequestrnServlet-Error: Malformed data sent to JServrnrn$| p/Jserv/
match nuttcp m|^KOnnuttcp-t: v([d.]+): error scanning parametersnmay be using older client version than servernrnKOn| p/nuttcp network throughput tester/ v/$1/
match backdoor m|^sh-2.05b$ | p/r0nin rootkit backdoor/
match wesnoth m|^x03x1fx02versionx04([d.]+)x02mustloginx05x01| p/Battle For Wesnoth game server/ v/$1/
match xboxdebug m|^201- connectedrn407- unknown commandrn$| p/Microsoft XBox Debugging Kit/ d/game console/
match xns m|^HELLO XBOX!$| p/Relax XBOX file server/ d/game console/
##############################NEXT PROBE##############################
Probe TCP GetRequest q|GET / HTTP/1.0rnrn|
rarity 1
ports 1,70,79,80-85,88,113,139,143,280,497,505,514,515,540,554,620,631,783,888,898,900,901,993,995,1026,1080,1214,1220,1234,1311,1314,1503,1830,1900,2001,2002,2030,2064,2160,2525,2715,2869,3000,3002,3052,3128,3280,3372,3531,3689,4000,4660,5000,5427,5060,5222,5269,5432,5800-5803,5900,6103,6346,6544,6600,6699,6969,7007,7070,7776,8000-8010,8080-8085,8118,8181,8443,8880-8888,9001,9030,9050,9080,9090,9999,10000,10005,11371,13013,13666,13722,14534,15000,18264,40193,50000,55555,4711
sslports 443
# Kerio PF 4.0.11 unregistered - Service process (Port 44xxx?) on MS W2K SP4+
match keriopfservice m|^(HTTP/1.0) 200 OKrnServer: Kerio Personal Firewallrn| p/Kerio PF 4 Service/ i/$1/
match backupexecra m|^xf6xffxffxffx10$| p/Veritas BackupExec Remote Agent/
match csta m|^<HTML>rn<HEAD>rn<TITLE>CSTA-Mono Server Home Page </TITLE>rn| p/Alcatel OmniPCX Enterprise/ d/PBX/
match dantzretrospect m|^xcax04$| p/Dantz Retrospect/ v/6.0/
match dnet-keyproxy m|^HTTP/1.0 302 FoundrnLocation: http://www.distributed.net/rnrn$| p/Distributed.Net HTTP Keyproxy/
# eXcelon XIS DXE console service V3.1 SP 3 on Solaris
match excelon-xis-dxe m|^GIOPx01x06GIOPx01x05$| p/eXcelon XIS DXE console service/
match oracle-java m|^GIOPx01x05| p/Oracle Java/
# Digital UNIX 5.6
match finger m|^Login name: / tttIn real life: ???rnrnLogin name: GET tttIn real life: ???rnrnLogin name: HTTP/1.0 tttIn real life: ???rn$| p/Digital UNIX fingerd/ o/DIGITAL UNIX/
# Internet Rex v2.67 Beta 1a
match finger m|^No such user No such user Nn$| p/Internet Rex finger server/
# FreeBSD 4.9-STABLE /usr/libexec/fingerd/
match finger m|^finger: /: no such userr?nfinger: GET: no such userr?nfinger: HTTP/1.0: no such userr?n$| p/FreeBSD fingerd/ o/FreeBSD/
# Bay Networks Micro Annex Comm. Server R10.0
match finger m|^No such activity.rn$| p/Bay Networks Micro Annex terminal server fingerd/
# Mercury/32 3.32 Finger Server module on Windows XP
match finger m|^GET / HTTP/1.0 is not known at this site.rn$| p|Mercury/32 fingerd| o|Windows|
# ffingerd 1.28
match finger m|^That user does not want to be fingered.n$| p/ffingerd/
# Finger 0.17 from debian linux (which is from Linux netkit I believe)
# OpenBSD 2.3
match finger m|^finger: GET: no such user.nfinger: /: no such user.nfinger: HTTP/1.0: no such user.n$| p|BSD/Linux fingerd|
# Linux port of in.fingerd from OpenBSD network tools - started with -w to show welcome banner
match finger m|^rnWelcome to Linux version (d[-.w]+) at ([-.w]+) !rnn.*(d+) user.*nrnfinger: GET: no such user.nfinger: /: no such user.nfinger: HTTP/1.0: no such user.n| p/OpenBSD fingerd/ i/ported to Linux; $2 users logged in/ o/Linux version $1/ h/$2/ o/Linux/
# Redhat Linux from finger-server-0.17-9 RPM
match finger m|^finger: GET: no such user.rnfinger: /: no such user.rnfinger: HTTP/1.0: no such user.rn$| p/Linux fingerd/ o/Linux/
# NetBSD 1.6ZA (berkeley fingerd 8.1 sibling)
match finger m|^finger: GET: no such usernfinger: /: no such usernfinger: HTTP/1.0: no such usern$| p/NetBSD fingerd/
# Solaris 9
match finger m|^Login Name TTY Idle When WherernGET ???rn/ ???rnHTTP/1.0 ???rn$| p/Sun Solaris fingerd/ o/Solaris/
# mlfingerd 1.1
match finger m|^Information for user 'GET+20+2F+20HTTP+2F1.0':rnUnknown user.rn$| p/mlfingerd/
# SGI IRIX 6.5.18f finger
match finger m|^Login name: GET tttIn real life: ???rn$| p/SGI IRIX or NeXTSTEP fingerd/
# Windows fingerd
match finger m|^No such usern$| p/Windows fingerd/ o/Windows/
match finger m|^MSS100 Version V([d/.]+)(d+) - Time Since Boot: d+:dd:ddrnName pid stat pc cpusec stack pr/sy idle ttyrn| p/Lantronix MSS100 serial interface fingerd/ v/$1/ d/specialized/
match finger m|^finger: GET / HTTP/1.0: no such usern| p/efingerd/ o/Unix/
match finger m|^ +-;;=n +.;M####+n| p/mIRC with ircN script fingerd/ o/Windows/
match finger m|^User not foundrn| p/XMail fingerd/
match finger m|^EMail : [w-_.]+@([w-_.]+)rn Real Name : ??rn Home Page : ??rn| p/XMail fingerd/ h/$1/
match finger m|^rnIntegrated portrnPrinter Type: IBM Infoprint (.*)rn| p/IBM Inforprint $1 fingerd/ d/print server/
match finger m|^Login name: HTTP/1.0 In real life: ???rn| p/OpenVMS fingerd/ o/OpenVMS/
match gnutella m|^HTTP/1.[01] 404 Not FoundrnServer: gtk-gnutella/(d[-.w]+) (([^)rn]+))rn| p/gtk-gnutella P2P client/ v/$1/ i/$2/
match gnutella m|^HTTP/1.[01] 403 Browse Host DisabledrnServer: gtk-gnutella/(d[-.w]+) (([^)rn]+))rn| p/gtk-gnutella P2P client/ v/$1/ i/$2; browse host disabled/
# LimeWire 3.5.8 on Suse Linux 8.1
match gnutella m|^HTTP/1.1 406 Not Acceptablern(rn)?$| p/LimeWire Gnutella P2P client/
match gnutella m|^HTTP/1.0 200rnServer: Mutellarn| p/Mutella Gnutella P2P client/
match gnutella m|^HTTP/1.1 404 Not FoundrnServer: giFT-Gnutella/(d[-.w]+)rn| p/GiFT P2P client gnutella module/ v/$1/
match gnutella m|^HTTP/1.1 200 OKrn.*Server: Shareaza (dS+)|s p/Shareaza/ v/$1/
match gnutella m|^HTTP/1.1 ddd .*rn.*Server: BearShare ([d.]+)rn|s p/BearShare Gnutella P2P client/ v/$1/
match gnutella m|^HTTP/1.1 ddd .*rn.*Server: BearShare ([d.]+) (([^)]+))rn|s p/BearShare Gnutella P2P client/ v/$1/ i/$2/
match gnutella m|^HTTP/1.1 ddd .*rnDate: .*rnServer: GhostWhiteCrab/([d.]+)rnConnection: closernrn| p/GhostWhiteCrab gnutella cache/ v/$1/
match gopher m|^HTTP/1.0 200 OkrnMIME-Version: 1.0rnServer: GopherWEB/(d[-.w]+)rn| p/Internet Gopher Server/ i/Gopher+ protocol; GopherWeb $1/
match gopher m|^0'/GET / HTTP/1.0' doesn't exist!tterror.hostt1rn.rn$| p/Bucktooth gopherd/
match gopher m|^3 --6 Bad Request. rn.rn$| p/Windows gopherd/ o/Windows/
match gopher-proxy m|^3That item is not currently available.rn$| p/Symantec gopher proxy/
# Needs to go before the Apache match lines -Doug