Overview Changelog

// Special Properties

_shodanlocation

// Protocols and Products

amqpscreenshotafpagent_zeroairplayandroid_debug_bridgeanerma_cf_forthartexauerswald_compact_seriesbacnetbeanstalkbgpbitcoincairncassandracheckpointchromachromecastcimdcisco_anyconnectcisco_ipslaclickhousecloudcloudclicoapcobalt_strike_beaconcockroachdbcodesysconsulcouchbase_servercouchbase_sync_gatewaycouchdbdahuadahua_dvr_webdavdcgm_exporterdd_wrtdgraphdigidnsdockerdocker_registrydocker_wyze_bridgedogecoin_nodedomoticzdraytek_vigordruidelasticelf_executable_fileepmdetcdethereum_p2pethereum_rpcethernetipfast_reverse_proxyflinkfortinetftpgangliageminigl_ineth323handpunchhbasehermes_agenthikvisionhivehome_assistanthomebridgehomematic_ccuhoobshp_printer_embedded_web_serverhp_ilohpe_oneviewhttphuawei_home_gatewayhubitatibm_db2influxdbiotawatt_configurationip_cameraip_symconipmiipp_cupsisakmpiscsikafkaknxkuberneteskyocera_printer_panell2tpmcpmembasempdlantronixldaplitecoin_nodellama_cpplocalaimdnsmicrosoft_exchangemilesight_routersmikrotik_routerosmikrotik_winboxmilvusminecraftmitsubishi_qmongodbmpls_ldpmsrpcmssqlmssql_ssrpmqttmysqlmysqlxnatsndmpneo4j_browsernetbiosnetdatanetgearnetusbnmeanode_exporternsqntlmntpntripcomfyuiopen_diropenflowopenhabopenwebnetoracle_tnslsnrpcworxpentagipgbouncerphilips_hueplexpptppqube3_power_analyzersquestdbqnapradiusraspberry_shakerdp_encryptionrealportredisreolink_baichuanriak_httpripripplersyncsamsung_tvsamsung_syncthru_web_serviceseven_days_to_dieshellysiemens_s7sipskywalkingsmbsnmpsonicwallsonossony_braviaspotify_connectsshsslsteam_a2ssteam_ihsstunstrixsupersetsynologysynology_dsmsynology_srmtacacstasmotatcptelnettibiatidbtilginAB_home_gatewaytp_link_kasatp_link_kasa_newtrane_tracer_scubiquitiudpunitronics_pcomupnpvaultvertxvespavmwarevncwg_easywince_cerdispwindows_exporterxiaomi_miioyeelightzeromq
Property
Example Data

tcp

TCP stack information about the IP. The "raw" and "fp" properties are a network stack fingerprint collected from the SYN/ACK that the IP sent in response to the crawler's TCP SYN. The same SYN is sent to every IP, so the differences between the responses come from the operating system's network stack. The "mptcp" property says whether the service accepts Multipath TCP connections.

Property Name Type Description Required
fp string Versioned, human-readable fingerprint key built from the "raw" headers in the format "t1_<initial TTL>_<window>_<window scale>_<options layout>_<quirks>". IPs with the same network stack share the same key. The property is missing if the headers couldn't be parsed. Ex: t1_64_t45_10_MSTNW_df,id0
mptcp Mptcp
raw string Hex-encoded IP and TCP headers of the SYN/ACK, without the IP addresses, ports, sequence and acknowledgement numbers. Contains the IP header fields up to the source address followed by the TCP header starting at the data offset, including the TCP options. Missing for banners that didn't come from the crawler's stateless SYN (ex. on-demand scans). Ex: 4500003c0000400040061e5fa012fe881c8c0000020405b40402080ab339356e2ec4a2820103030a

Mptcp

Multipath TCP (RFC 8684) support of the service. The crawler sends a SYN with an MP_CAPABLE option and checks whether the SYN/ACK echoes it. Only collected for HTTPS services on port 443 and missing if the service didn't answer the SYN.

Property Name Type Description Required
flags integer Flags byte of the MP_CAPABLE option of the SYN/ACK (A: checksum required = 0x80, B: extensibility = 0x40, C: don't connect to the source address = 0x20, H: HMAC-SHA256 = 0x01). Only present if "supported" is true. Ex: 1
supported boolean True if the SYN/ACK contained an MP_CAPABLE option, which means the service accepts MPTCP connections. False if the service answered with a regular SYN/ACK. Yes
version integer MPTCP protocol version from the MP_CAPABLE option of the SYN/ACK (0 for RFC 6824, 1 for RFC 8684). Only present if "supported" is true. Ex: 1


↑ TopExample 
{
    "raw": "4500003c0000400040061e5fa012fe881c8c0000020405b40402080ab339356e2ec4a2820103030a",
    "fp": "t1_64_t45_10_MSTNW_df,id0",
    "mptcp": {
        "supported": true,
        "version": 1,
        "flags": 1
    }
}