recog 2.1.18 → 2.1.19

Sign up to get free protection for your applications and to get access to all the features.
Files changed (4) hide show
  1. checksums.yaml +4 -4
  2. data/lib/recog/version.rb +1 -1
  3. data/xml/smtp_banners.xml +557 -666
  4. metadata +3 -3
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 2dfccd0a5a515fd50d6e1b37df8eecc70c1d66b2
4
- data.tar.gz: af23bc1ecb8338a683a5d9a0ad08b46ef111a545
3
+ metadata.gz: ca666a0361fcb46b9fb7bca00434fdfd98b98f99
4
+ data.tar.gz: b0f0741ca09a7e715f275c72ee1b56865a5239b8
5
5
  SHA512:
6
- metadata.gz: 69850c82b9b6e62ffffaa4e90337e89cdf404c467c3ca9097a0726246b2ddda82fe771810d3d1cf166da4bf67bcd675db63cb49571f65f372ca03dae8ed086f4
7
- data.tar.gz: 47d6cd3edbd0ef2d24761a88273955e4d5d9a38b128b961369326384c7900576338675389c403d327138eb1591d67ed69c4bffcd1345dad6573769ca3a38bfed
6
+ metadata.gz: fa394f748d7dc282b765434e8ffd234b0c6071af08db6d43b161f4287b32e4fd3701a0f1811a35ea3278826dcb4243ef3c0e99c1f961ae97afa2eba2f66fd37e
7
+ data.tar.gz: 6d375315056567afc494c1b0727f0db9f27c03303656a4728d0abdb8c35ac8d08eaf5939c1bb14b568de8ebd1a362d5a2588384a7f137ce19212e9c37b487be3
data/lib/recog/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module Recog
2
- VERSION = '2.1.18'
2
+ VERSION = '2.1.19'
3
3
  end
data/xml/smtp_banners.xml CHANGED
@@ -24,7 +24,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
24
24
  -->
25
25
  <fingerprints matches="smtp.banner" protocol="smtp" database_type="service" preference="0.20">
26
26
  <fingerprint pattern="^X1 NT-ESMTP Server ([^ ]+) \(IMail (\d+\.[^ ]+) EVAL \d+-\d+\)$">
27
- <description>IMail EVAL version</description>
27
+ <description>IMail - EVAL version</description>
28
28
  <example service.version="6.06">X1 NT-ESMTP Server foo.bar (IMail 6.06 EVAL 11347-1)</example>
29
29
  <param pos="0" name="service.vendor" value="Ipswitch"/>
30
30
  <param pos="0" name="service.family" value="IMail Server"/>
@@ -34,7 +34,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
34
34
  <param pos="0" name="imail.eval" value="yes"/>
35
35
  </fingerprint>
36
36
  <fingerprint pattern="^X1 NT-ESMTP Server ([^ ]+) \(IMail (\d+\.[^ ]+) \d+-\d+\)$">
37
- <description>IMail non-EVAL version</description>
37
+ <description>IMail - non-EVAL version</description>
38
38
  <example service.version="6.06">X1 NT-ESMTP Server foo.bar (IMail 6.06 899085-1)</example>
39
39
  <param pos="0" name="service.vendor" value="Ipswitch"/>
40
40
  <param pos="0" name="service.family" value="IMail Server"/>
@@ -43,7 +43,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
43
43
  <param pos="1" name="host.name"/>
44
44
  </fingerprint>
45
45
  <fingerprint pattern="^([^ ]+) \(IMail (\d+\.[^ ]+) \d+-\d+\) NT-ESMTP Server X1$">
46
- <description>IMail non-EVAL version, NT-ESMTP at end</description>
46
+ <description>IMail - non-EVAL version, NT-ESMTP at end</description>
47
47
  <example service.version="12.4.2.27">foo.bar (IMail 12.4.2.27 21349-1) NT-ESMTP Server X1</example>
48
48
  <param pos="0" name="service.vendor" value="Ipswitch"/>
49
49
  <param pos="0" name="service.family" value="IMail Server"/>
@@ -52,10 +52,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
52
52
  <param pos="1" name="host.name"/>
53
53
  </fingerprint>
54
54
  <fingerprint pattern="^([^ ]+) SMTP AnalogX Proxy ([^ ]+\.[^ ]+) \(Release\) ready *$">
55
- <description>
56
- AnalogX proxy
57
- http://www.analogx.com/contents/download/network/proxy.htm
58
- </description>
55
+ <description>AnalogX proxy (http://www.analogx.com/contents/download/network/proxy.htm)</description>
59
56
  <example host.name="192.168.1.1" service.version="4.15">192.168.1.1 SMTP AnalogX Proxy 4.15 (Release) ready</example>
60
57
  <param pos="0" name="service.vendor" value="AnalogX"/>
61
58
  <param pos="0" name="service.family" value="Proxy"/>
@@ -64,38 +61,45 @@ The system or service fingerprint with the highest certainty overwrites the othe
64
61
  <param pos="1" name="host.name"/>
65
62
  </fingerprint>
66
63
  <fingerprint pattern="^ArGoSoft Mail Server, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
67
- <description>
68
- ArGoSoft Mail Server is fully functional STMP/POP3/Finger server for Windows 95/98/NT/2000.
69
- http://www.argosoft.com/applications/mailserver/
70
- Example: 220 ArGoSoft Mail Server, Version 1.4 (1.4.0.3)
71
- </description>
64
+ <description>ArGoSoft Mail Server</description>
65
+ <example service.version="1.4.0.7">ArGoSoft Mail Server, Version 1.4 (1.4.0.7)</example>
66
+ <param pos="0" name="os.vendor" value="Microsoft"/>
67
+ <param pos="0" name="os.family" value="Windows"/>
68
+ <param pos="0" name="os.product" value="Windows"/>
72
69
  <param pos="0" name="service.vendor" value="ArGoSoft"/>
73
70
  <param pos="0" name="service.family" value="Mail Server"/>
74
71
  <param pos="0" name="service.product" value="Mail Server"/>
75
72
  <param pos="1" name="service.version"/>
76
73
  </fingerprint>
77
- <fingerprint pattern="^(\S+) ArGoSoft Mail Server Freeware, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
78
- <description>ArGoSoft Mail, freeware version</description>
79
- <example host.name="example.com" service.version="1.8.8.8">example.com ArGoSoft Mail Server Freeware, Version 1.8 (1.8.8.8)</example>
74
+ <fingerprint pattern="^^(?:(\S+) +)?ArGoSoft Mail Server Freeware, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
75
+ <description>ArGoSoft Mail Server - freeware version</description>
76
+ <example host.name="foo.bar" service.version="1.8.8.8">foo.bar ArGoSoft Mail Server Freeware, Version 1.8 (1.8.8.8)</example>
77
+ <example service.version="1.8.8.8">ArGoSoft Mail Server Freeware, Version 1.8 (1.8.8.8)</example>
78
+ <param pos="0" name="os.vendor" value="Microsoft"/>
79
+ <param pos="0" name="os.family" value="Windows"/>
80
+ <param pos="0" name="os.product" value="Windows"/>
80
81
  <param pos="0" name="service.vendor" value="ArGoSoft"/>
81
82
  <param pos="0" name="service.family" value="Mail Server"/>
82
83
  <param pos="0" name="service.product" value="Mail Server"/>
83
84
  <param pos="2" name="service.version"/>
84
85
  <param pos="1" name="host.name"/>
85
86
  </fingerprint>
86
- <fingerprint pattern="^ArGoSoft Mail Server Pro for WinNT\/2000(?:\/XP)?, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
87
- <description>ArGoSoft Mail, Pro version </description>
87
+ <fingerprint pattern="^(?:(\S+) +)?ArGoSoft Mail Server Pro for WinNT\/2000(?:\/XP)?, Version [^ ]+ \(([^ ]+\.[^ ]+\.[^ ]+\.[^ ]+)\) *$">
88
+ <description>ArGoSoft Mail Server - Pro version</description>
88
89
  <example service.version="1.6.1.8">ArGoSoft Mail Server Pro for WinNT/2000, Version 1.61 (1.6.1.8)</example>
89
90
  <example service.version="1.8.9.5">ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.5)</example>
91
+ <example host.name="foo.bar" service.version="1.8.9.5">foo.bar ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.9.5)</example>
92
+ <param pos="0" name="os.vendor" value="Microsoft"/>
93
+ <param pos="0" name="os.family" value="Windows"/>
94
+ <param pos="0" name="os.product" value="Windows"/>
90
95
  <param pos="0" name="service.vendor" value="ArGoSoft"/>
91
96
  <param pos="0" name="service.family" value="Mail Server"/>
92
97
  <param pos="0" name="service.product" value="Mail Server"/>
93
- <param pos="1" name="service.version"/>
98
+ <param pos="1" name="host.name"/>
99
+ <param pos="2" name="service.version"/>
94
100
  </fingerprint>
95
101
  <fingerprint pattern="^([^ ]+) +AppleShare IP Mail Server ([^ ]+\.[\d.]+) SMTP Server Ready *$">
96
- <description>
97
- AppleShare IP Mail Server
98
- </description>
102
+ <description>AppleShare IP Mail Server</description>
99
103
  <example service.version="6.2.1">foo.bar AppleShare IP Mail Server 6.2.1 SMTP Server Ready</example>
100
104
  <example service.version="6.2">foo.bar AppleShare IP Mail Server 6.2 SMTP Server Ready</example>
101
105
  <param pos="0" name="service.vendor" value="Apple"/>
@@ -105,9 +109,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
105
109
  <param pos="2" name="service.version"/>
106
110
  </fingerprint>
107
111
  <fingerprint pattern="^CheckPoint FireWall-1 secure E?SMTP server *$">
108
- <description>
109
- CheckPoint FireWall-1
110
- </description>
112
+ <description>CheckPoint FireWall-1</description>
111
113
  <example>CheckPoint FireWall-1 secure SMTP server</example>
112
114
  <example>CheckPoint FireWall-1 secure ESMTP server</example>
113
115
  <param pos="0" name="service.vendor" value="Check Point"/>
@@ -115,9 +117,8 @@ The system or service fingerprint with the highest certainty overwrites the othe
115
117
  <param pos="0" name="service.product" value="Firewall-1"/>
116
118
  </fingerprint>
117
119
  <fingerprint pattern="^SMTP/cmap ready_+$">
118
- <description>
119
- Cisco Pix v4.x
120
- </description>
120
+ <description>Cisco Pix v4.x</description>
121
+ <example>SMTP/cmap ready________________________________________________________________________</example>
121
122
  <param pos="0" name="service.vendor" value="Cisco"/>
122
123
  <param pos="0" name="service.family" value="PIX"/>
123
124
  <param pos="0" name="service.product" value="PIX"/>
@@ -148,8 +149,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
148
149
  <param pos="0" name="service.product" value="PIX"/>
149
150
  </fingerprint>
150
151
  <fingerprint pattern="^([^ ]+) +ESMTP CPMTA-([^ ]+)_([^ ]+)_([^ ]+)_([^ ]+) - NO UCE *$">
151
- <description>
152
- Critical Path (aka InScribe) Messaging Server
152
+ <description>Critical Path (aka InScribe) Messaging Server
153
153
  http://www.cp.net/products/inscr_messagingserv_overview.html
154
154
  Runs on Windows NT4/2k, Solaris 2.6, 2.7, and 2.8 Sparc/Intel, SGI IRIX 6.5.3 or later, and AIX
155
155
  </description>
@@ -163,22 +163,16 @@ The system or service fingerprint with the highest certainty overwrites the othe
163
163
  <param pos="5" name="service.version.version.version.version"/>
164
164
  </fingerprint>
165
165
  <fingerprint pattern="^CSM Internet Mail Scanner SMTP-Gateway ready?\. *$">
166
- <description>
167
- CSM Internet Mail Scanner SMTP proxy
168
- see http://www.csm-usa.com/product/ims/release.htm
169
- TODO: Some versions return a typo "read." instead of "ready." - use this to fingerprint
170
- example: 220 CSM Internet Mail Scanner SMTP-Gateway ready.
171
- example: 220 CSM Internet Mail Scanner SMTP-Gateway read.
172
- </description>
166
+ <description>CSM Internet Mail Scanner SMTP Proxy</description>
167
+ <example>CSM Internet Mail Scanner SMTP-Gateway ready.</example>
168
+ <example>CSM Internet Mail Scanner SMTP-Gateway read.</example>
173
169
  <param pos="0" name="service.vendor" value="CSM"/>
174
170
  <param pos="0" name="service.family" value="Internet Mail Scanner"/>
175
171
  <param pos="0" name="service.product" value="Internet Mail Scanner"/>
176
172
  </fingerprint>
177
173
  <fingerprint pattern="^([^ ]+) +IMS SMTP Receiver Version ([^ ]+\.[^ ]+) Ready *$">
178
- <description>
179
- EMWAC Internet Mail Services http://emwac.ed.ac.uk/html/internet_toolchest/ims/ims.htm
180
- example: 220 gabriela.networld.com.ar IMS SMTP Receiver Version 0.83 Ready
181
- </description>
174
+ <description>EMWAC Internet Mail Services (http://emwac.ed.ac.uk/html/internet_toolchest/ims/ims.htm)</description>
175
+ <example service.version="0.83" host.name="foo.bar">foo.bar IMS SMTP Receiver Version 0.83 Ready</example>
182
176
  <param pos="0" name="service.vendor" value="EMWAC"/>
183
177
  <param pos="0" name="service.family" value="Internet Mail Services"/>
184
178
  <param pos="0" name="service.product" value="Internet Mail Services"/>
@@ -186,7 +180,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
186
180
  <param pos="2" name="service.version"/>
187
181
  </fingerprint>
188
182
  <fingerprint pattern="^([^ ]+) running Eudora Internet Mail Server (\d\.[\d.]+) *$">
189
- <description> Eudora Internet Mail Server</description>
183
+ <description>Eudora Internet Mail Server</description>
190
184
  <example service.version="3.0.2" host.name="foo.bar">foo.bar running Eudora Internet Mail Server 3.0.2</example>
191
185
  <example service.version="2.2" host.name="foo.bar">foo.bar running Eudora Internet Mail Server 2.2</example>
192
186
  <param pos="0" name="service.vendor" value="Eudora"/>
@@ -200,10 +194,8 @@ The system or service fingerprint with the highest certainty overwrites the othe
200
194
  <param pos="2" name="service.version"/>
201
195
  </fingerprint>
202
196
  <fingerprint pattern="^([^ ]+) +ESMTP Server \(Microsoft Exchange Internet Mail Service (\d+\.\d+\.\d+\.\d+)\) ready *$">
203
- <description>
204
- Microsoft Exchange Server 5.5 and above
205
- (for sure, can't be confused with the IIS builtin SMTP service)
206
- </description>
197
+ <description>Microsoft Exchange Server 5.5 and above (for sure, can't be confused with the IIS builtin SMTP service)</description>
198
+ <example host.name="foo.bar" service.version="5.5.2653.13">foo.bar ESMTP Server (Microsoft Exchange Internet Mail Service 5.5.2653.13) ready</example>
207
199
  <param pos="0" name="service.vendor" value="Microsoft"/>
208
200
  <param pos="0" name="service.family" value="Exchange Server"/>
209
201
  <param pos="0" name="service.product" value="Exchange Server"/>
@@ -215,10 +207,8 @@ The system or service fingerprint with the highest certainty overwrites the othe
215
207
  <param pos="0" name="os.product" value="Windows"/>
216
208
  </fingerprint>
217
209
  <fingerprint pattern="^([^ ]+) Microsoft Exchange Internet Mail Service (\d+\.\d+\.\d+\.\d+) ready *$">
218
- <description>
219
- Microsoft Exchange Server 5.0
220
- (for sure, can't be confused with the IIS builtin SMTP service)
221
- </description>
210
+ <description>Microsoft Exchange Server 5.0 (for sure, can't be confused with the IIS builtin SMTP service)</description>
211
+ <example host.name="foo.bar" service.version="5.0.1460.8">foo.bar Microsoft Exchange Internet Mail Service 5.0.1460.8 ready</example>
222
212
  <param pos="0" name="service.vendor" value="Microsoft"/>
223
213
  <param pos="0" name="service.family" value="Exchange Server"/>
224
214
  <param pos="0" name="service.product" value="Exchange Server"/>
@@ -230,11 +220,8 @@ The system or service fingerprint with the highest certainty overwrites the othe
230
220
  <param pos="0" name="os.product" value="Windows"/>
231
221
  </fingerprint>
232
222
  <fingerprint pattern="^([^ ]+) Microsoft ESMTP MAIL Service ready at .*$">
233
- <description>
234
- Microsoft Exchange 2007/2010
235
- (for sure, can't be confused with the IIS builtin SMTP service)
236
- </description>
237
- <example>foo Microsoft ESMTP MAIL Service ready at Wed, 21 Jul 2010 19:04:24 -0700</example>
223
+ <description>Microsoft Exchange 2007/2010 (for sure, can't be confused with the IIS builtin SMTP service)</description>
224
+ <example>foo.bar Microsoft ESMTP MAIL Service ready at Wed, 21 Jul 2010 19:04:24 -0700</example>
238
225
  <param pos="0" name="service.vendor" value="Microsoft"/>
239
226
  <param pos="0" name="service.family" value="Exchange Server"/>
240
227
  <param pos="0" name="service.product" value="Exchange Server"/>
@@ -245,77 +232,77 @@ The system or service fingerprint with the highest certainty overwrites the othe
245
232
  <param pos="0" name="os.product" value="Windows"/>
246
233
  </fingerprint>
247
234
  <fingerprint pattern="^([^ ]+) Microsoft SMTP MAIL ready at (.+) Version: +(\d+\.\d+\.\d+\.\d+\.\d+) *$">
248
- <description>
249
- Microsoft IIS builtin SMTP service, or Microsoft Exchange Server
250
- (they are differentiated from each other in smtp-iis.clp)
251
- </description>
235
+ <description>Microsoft IIS builtin SMTP service, or Microsoft Exchange Server (they are differentiated from each other in smtp-iis.clp) - variant 1</description>
236
+ <example host.name="foo.bar" service.version="5.5.1877.197.19">foo.bar Microsoft SMTP MAIL ready at Wed, 29 Nov 2017 23:48:59 +0000 Version: 5.5.1877.197.19</example>
252
237
  <param pos="0" name="service.vendor" value="Microsoft"/>
253
238
  <param pos="0" name="service.family" value="IIS"/>
254
239
  <param pos="0" name="service.product" value="IIS"/>
255
240
  <param pos="3" name="service.version"/>
256
241
  <param pos="1" name="host.name"/>
257
242
  <param pos="2" name="system.time"/>
258
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
243
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
259
244
  <param pos="0" name="os.vendor" value="Microsoft"/>
260
245
  <param pos="0" name="os.family" value="Windows"/>
261
246
  <param pos="0" name="os.device" value="General"/>
262
247
  <param pos="0" name="os.product" value="Windows"/>
263
248
  </fingerprint>
264
- <fingerprint pattern="^([^ ]+) +Microsoft ESMTP MAIL Service, Version: +(\d+\.\d+\.\d+\.\d+) +ready at +(.+)$">
265
- <description>
266
- Microsoft IIS builtin SMTP service, or Microsoft Exchange Server
267
- (they are differentiated from each other in smtp-iis.clp)
268
- </description>
249
+ <fingerprint pattern="^(:?[^ ]+)? ?Microsoft ESMTP MAIL Service, Version: +(\d+\.\d+\.\d+\.\d+) +ready +(?:at +)?(.+)$">
250
+ <description>Microsoft IIS builtin SMTP service, or Microsoft Exchange Server (they are differentiated from each other in smtp-iis.clp) - variant 2 </description>
251
+ <example service.version="5.0.2195.5329"> Microsoft ESMTP MAIL Service, Version: 5.0.2195.5329 ready Thu, 30 Nov 2017 11:40:25 +0200</example>
269
252
  <example service.version="6.0.3790.4675">foo Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Wed, 21 Jul 2010 19:04:24 -0700</example>
253
+ <example service.version="6.0.2600.5512" system.time="Thu, 30 Nov 2017 18:22:40 +0900">Microsoft ESMTP MAIL Service, Version: 6.0.2600.5512 ready at Thu, 30 Nov 2017 18:22:40 +0900</example>
270
254
  <param pos="0" name="service.vendor" value="Microsoft"/>
271
255
  <param pos="0" name="service.family" value="IIS"/>
272
256
  <param pos="0" name="service.product" value="IIS"/>
273
257
  <param pos="2" name="service.version"/>
274
258
  <param pos="1" name="host.name"/>
275
259
  <param pos="3" name="system.time"/>
276
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
260
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
277
261
  <param pos="0" name="os.vendor" value="Microsoft"/>
278
262
  <param pos="0" name="os.family" value="Windows"/>
279
263
  <param pos="0" name="os.device" value="General"/>
280
264
  <param pos="0" name="os.product" value="Windows"/>
281
265
  </fingerprint>
282
266
  <fingerprint pattern="^ESMTP Exim$">
283
- <description>Exim without version string or hostname</description>
267
+ <description>Exim - without version string or hostname</description>
284
268
  <example>ESMTP Exim</example>
285
269
  <param pos="0" name="service.vendor" value="exim"/>
286
270
  <param pos="0" name="service.family" value="exim"/>
287
271
  <param pos="0" name="service.product" value="exim"/>
288
272
  </fingerprint>
289
- <fingerprint pattern="^ ?([^, ]+)(?:,)? ESMTP (?i:Exim) +(\d+\.[\d_.-]+)(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *(?:We do not authorize the use of this system to transport unsolicited, and\/or bulk e-mail.)?$">
290
- <description>Exim with version string and optional timestamp</description>
273
+ <fingerprint pattern="^ ?([^, ]+)(?:,)? ESMTP \(?(?i:Exim) +(\d+\.[\d_.bRC-]+)\)?(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *(?:We do not authorize the use of this system to transport unsolicited, and\/or bulk e-mail.)?$">
274
+ <description>Exim - with version string and optional timestamp</description>
291
275
  <example service.version="4.89" host.name="foo.bar">foo.bar ESMTP Exim 4.89 "</example>
292
- <example service.version="4.83" host.name="foo.bar">foo.bar, ESMTP EXIM 4.83"</example>
293
- <example service.version="4.84_2" host.name="foo.bar">foo.bar ESMTP Exim 4.84_2 "</example>
276
+ <example service.version="4.83" host.name="foo.bar">foo.bar, ESMTP EXIM 4.83</example>
277
+ <example service.version="4.84_2" host.name="foo.bar">foo.bar ESMTP Exim 4.84_2 </example>
278
+ <example service.version="4.90_RC3" host.name="foo.bar">foo.bar ESMTP Exim 4.90_RC3 Thu, 30 Nov 2017 03:52:16 -0700 </example>
279
+ <example service.version="4.89_1b" host.name="foo.bar">foo.bar ESMTP Exim 4.89_1b Thu, 05 Apr 2018 21:30:37 +0200</example>
294
280
  <example service.version="4.89-122312">foo.bar ESMTP Exim 4.89-122312 Thu, 16 Nov 2017 10:33:38 +0200 </example>
281
+ <example service.version="4.87">foo.bar ESMTP (Exim 4.87) Thu, 30 Nov 2017 03:25:58 -0800 </example>
295
282
  <example service.version="4.80" system.time="Thu, 16 Nov 2017 01:04:30 -0800">foo.bar ESMTP Exim 4.80 Thu, 16 Nov 2017 01:04:30 -0800 </example>
296
283
  <example service.version="3.12" system.time="Wed, 31 Jan 2001 15:47:23 +1100">foo.bar ESMTP Exim 3.12 #1 Wed, 31 Jan 2001 15:47:23 +1100 </example>
297
284
  <example service.version="4.89" host.name="foo.bar"> foo.bar ESMTP Exim 4.89 #1 Thu, 16 Nov 2017 04:55:31 -0500 We do not authorize the use of this system to transport unsolicited, and/or bulk e-mail.</example>
298
285
  <param pos="0" name="service.vendor" value="exim"/>
299
286
  <param pos="0" name="service.family" value="exim"/>
300
287
  <param pos="0" name="service.product" value="exim"/>
301
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
288
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
302
289
  <param pos="1" name="host.name"/>
303
290
  <param pos="2" name="service.version"/>
304
291
  <param pos="3" name="system.time"/>
305
292
  </fingerprint>
306
293
  <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim) +(\d+) ((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
307
- <description>Exim with digit only version string and optional timestamp</description>
294
+ <description>Exim - with digit only version string and optional timestamp</description>
308
295
  <example service.version="125302" host.name="foo.bar">foo.bar ESMTP Exim 125302 Thu, 16 Nov 2017 04:55:11 -0500 </example>
309
296
  <param pos="0" name="service.vendor" value="exim"/>
310
297
  <param pos="0" name="service.family" value="exim"/>
311
298
  <param pos="0" name="service.product" value="exim"/>
312
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
299
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
313
300
  <param pos="1" name="host.name"/>
314
301
  <param pos="2" name="service.version"/>
315
302
  <param pos="3" name="system.time"/>
316
303
  </fingerprint>
317
304
  <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim) +(\d+\.[\d_.]+)(?: +#\d)? Ubuntu ((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
318
- <description>Exim with version string and optional timestamp (Ubuntu)</description>
305
+ <description>Exim - with version string and optional timestamp (Ubuntu)</description>
319
306
  <example service.version="4.82" system.time="Thu, 16 Nov 2017 11:30:44 +0300">foo.bar ESMTP Exim 4.82 Ubuntu Thu, 16 Nov 2017 11:30:44 +0300 </example>
320
307
  <param pos="0" name="os.vendor" value="Ubuntu"/>
321
308
  <param pos="0" name="os.family" value="Linux"/>
@@ -323,60 +310,57 @@ The system or service fingerprint with the highest certainty overwrites the othe
323
310
  <param pos="0" name="service.vendor" value="exim"/>
324
311
  <param pos="0" name="service.family" value="exim"/>
325
312
  <param pos="0" name="service.product" value="exim"/>
326
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
313
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
327
314
  <param pos="1" name="host.name"/>
328
315
  <param pos="2" name="service.version"/>
329
316
  <param pos="3" name="system.time"/>
330
317
  </fingerprint>
331
- <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim) *((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
332
- <description>Exim without version string and with optional timestamp</description>
318
+ <fingerprint pattern="^([^, ]+)(?:,)? ESMTP (?i:Exim)(?: +#\d)? *((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
319
+ <description>Exim - without version string and with optional timestamp</description>
333
320
  <example host.name="foo.bar">foo.bar ESMTP Exim</example>
334
321
  <example host.name="foo.bar" system.time="Thu, 16 Nov 2017 01:11:30 -0800">foo.bar ESMTP Exim Thu, 16 Nov 2017 01:11:30 -0800 </example>
322
+ <example host.name="foo.bar" system.time="Thu, 30 Nov 2017 05:31:32 -0500">foo.bar ESMTP Exim #1 Thu, 30 Nov 2017 05:31:32 -0500 </example>
335
323
  <param pos="0" name="service.vendor" value="exim"/>
336
324
  <param pos="0" name="service.family" value="exim"/>
337
325
  <param pos="0" name="service.product" value="exim"/>
338
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
326
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
339
327
  <param pos="1" name="host.name"/>
340
328
  <param pos="2" name="system.time"/>
341
329
  </fingerprint>
342
330
  <fingerprint pattern="^ ?ESMTP (?i:Exim) (\d+\.[\d_.]+)(?: +#\d)? ?.?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?) *$">
343
- <description>Exim without hostname</description>
331
+ <description>Exim - without hostname</description>
344
332
  <example service.version="4.82" system.time="Thu, 16 Nov 2017 12:19:22 +0300">ESMTP Exim 4.82 Thu, 16 Nov 2017 12:19:22 +0300 </example>
345
333
  <example service.version="4.82"> ESMTP Exim 4.82 Thu, 16 Nov 2017 11:41:41 +0300 </example>
346
334
  <example service.version="4.89"> ESMTP Exim 4.89 #1 Thu, 16 Nov 2017 07:32:28 -0200 </example>
347
335
  <param pos="0" name="service.vendor" value="exim"/>
348
336
  <param pos="0" name="service.family" value="exim"/>
349
337
  <param pos="0" name="service.product" value="exim"/>
350
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
338
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
351
339
  <param pos="1" name="service.version"/>
352
340
  <param pos="2" name="system.time"/>
353
341
  </fingerprint>
354
342
  <fingerprint pattern="^([^ ]+) FTGate server ready .*$">
355
- <description>
356
- FTGate mail server, runs on Windows 9x/NT/2k
357
- http://www.ftgate.com
358
- </description>
343
+ <description>FTGate mail server, runs on Windows 9x/NT/2k (http://www.ftgate.com)</description>
359
344
  <example host.name="foo.bar">foo.bar FTGate server ready -attitude [C.o.r.E]</example>
360
345
  <param pos="0" name="service.vendor" value="Floosietek"/>
361
346
  <param pos="0" name="service.family" value="FTGate"/>
362
347
  <param pos="0" name="service.product" value="FTGate"/>
363
348
  <param pos="1" name="host.name"/>
364
349
  </fingerprint>
365
- <fingerprint pattern="^(?:[^ ]+) +SMTP/smap Ready\.$">
366
- <description>
367
- TIS FWTK and derivatives
350
+ <fingerprint pattern="^([^ ]+) +SMTP/smap Ready\.$">
351
+ <description>TIS FWTK and derivatives
368
352
  http://www.tis.com/research/software/
369
353
  This fingerprint may be ambiguous because other firewalls (like
370
354
  Gauntlet) are derived from TIS
371
355
  </description>
356
+ <example host.name="foo.bar">foo.bar SMTP/smap Ready.</example>
372
357
  <param pos="0" name="service.vendor" value="TIS"/>
373
358
  <param pos="0" name="service.family" value="FWTK"/>
374
359
  <param pos="0" name="service.product" value="FWTK"/>
360
+ <param pos="1" name="host.name"/>
375
361
  </fingerprint>
376
362
  <fingerprint pattern="^([^ ]+) GroupWise Internet Agent ([^ ]+\.[^ ]+\.[^ ]+) Ready \(C\).* Novell, Inc\. *$">
377
- <description>
378
- Novell GroupWise Internet Agent versions 5 and higher
379
- </description>
363
+ <description>Novell GroupWise Internet Agent - versions 5 and higher</description>
380
364
  <example service.version="5.5.1">foo.bar GroupWise Internet Agent 5.5.1 Ready (C)1993, 1998 Novell, Inc.</example>
381
365
  <param pos="0" name="service.vendor" value="Novell"/>
382
366
  <param pos="0" name="service.family" value="GroupWise"/>
@@ -385,9 +369,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
385
369
  <param pos="2" name="service.version"/>
386
370
  </fingerprint>
387
371
  <fingerprint pattern="^([^ ]+) GroupWise Internet Agent (\d+\.[\d.]+) Copyright .*\d{4}-\d{4} Novell, Inc..* All rights reserved. Ready *$">
388
- <description>
389
- Novell GroupWise Internet Agent versions 5 and higher, second variant
390
- </description>
372
+ <description>Novell GroupWise Internet Agent - versions 5 and higher, second variant</description>
391
373
  <example service.version="8.0.3">foo.bar GroupWise Internet Agent 8.0.3 Copyright (c) 1993-2012 Novell, Inc. All rights reserved. Ready</example>
392
374
  <example service.version="14.2.1">foo.bar GroupWise Internet Agent 14.2.1 Copyright 1993-2016 Novell, Inc., a Micro Focus Company. All rights reserved. Ready</example>
393
375
  <param pos="0" name="service.vendor" value="Novell"/>
@@ -397,10 +379,8 @@ The system or service fingerprint with the highest certainty overwrites the othe
397
379
  <param pos="2" name="service.version"/>
398
380
  </fingerprint>
399
381
  <fingerprint pattern="^([^ ]+) GroupWise SMTP/MIME Daemon ([^ ]+\.[^ ]+) v([^ ]+) Ready \(C\).* Novell, Inc\. *$">
400
- <description>
401
- Novell GroupWise versions below 5
402
- example: 220 bates.at GroupWise SMTP/MIME Daemon 4.1 v3 Ready (C)1993, 1996 Novell, Inc.
403
- </description>
382
+ <description>Novell GroupWise - versions below 5</description>
383
+ <example host.name="foo.bar" service.version="4.1" service.version.version="3">foo.bar GroupWise SMTP/MIME Daemon 4.1 v3 Ready (C)1993, 1996 Novell, Inc.</example>
404
384
  <param pos="0" name="service.vendor" value="Novell"/>
405
385
  <param pos="0" name="service.family" value="GroupWise"/>
406
386
  <param pos="0" name="service.product" value="GroupWise"/>
@@ -408,35 +388,15 @@ The system or service fingerprint with the highest certainty overwrites the othe
408
388
  <param pos="2" name="service.version"/>
409
389
  <param pos="3" name="service.version.version"/>
410
390
  </fingerprint>
411
- <fingerprint pattern="^([^ ]+) running IBM VM SMTP (.+) on (.+) *$">
412
- <description>
413
- IBM SMTP server for VM/ESA on IBM S/390 and IBM eserver z/Series 900.
414
- http://www.vm.ibm.com
415
- http://www-1.ibm.com/servers/eserver/zseries/
416
- http://mitvma.mit.edu/system/vm.html
417
- example: 220 mail.foo.bar running IBM VM SMTP Level 3A0 on Mon, 10 Sep 2001 07:21:54 EDT
418
- example: 220 mail.foo.bar running IBM VM SMTP V2R4 on Mon, 10 Sep 2001 12:23:47 +0100
419
- </description>
391
+ <fingerprint pattern="^([^ ]+) (?:ESMTP )?running IBM VM SMTP (.+)(?:; | on )(.+) *$">
392
+ <description>IBM SMTP server for VM/ESA on IBM S/390 and IBM eserver z/Series 900.</description>
393
+ <example service.version="Level 640" system.time="Thu, 30 Nov 2017 01:08:59 PDT">foo.bar running IBM VM SMTP Level 640 on Thu, 30 Nov 2017 01:08:59 PDT</example>
394
+ <example service.version="Level 3A0">foo.bar running IBM VM SMTP Level 3A0 on Mon, 10 Sep 2001 07:21:54 EDT</example>
395
+ <example service.version="V2R4" system.time="Mon, 10 Sep 2001 07:24:35 -0400 (EDT)">foo.bar ESMTP running IBM VM SMTP V2R4; Mon, 10 Sep 2001 07:24:35 -0400 (EDT)</example>
420
396
  <param pos="0" name="service.vendor" value="IBM"/>
421
397
  <param pos="0" name="service.family" value="VM"/>
422
398
  <param pos="0" name="service.product" value="VM"/>
423
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
424
- <param pos="1" name="host.name"/>
425
- <param pos="2" name="service.version"/>
426
- <param pos="3" name="system.time"/>
427
- </fingerprint>
428
- <fingerprint pattern="^([^ ]+) running IBM VM SMTP (.+); (.+) *$">
429
- <description>
430
- IBM SMTP server for VM/ESA on IBM S/390 and IBM eserver z/Series 900.
431
- http://www.vm.ibm.com
432
- http://www-1.ibm.com/servers/eserver/zseries/
433
- http://mitvma.mit.edu/system/vm.html
434
- example: 220 mail.foo.bar ESMTP running IBM VM SMTP V2R4; Mon, 10 Sep 2001 07:24:35 -0400 (EDT)
435
- </description>
436
- <param pos="0" name="service.vendor" value="IBM"/>
437
- <param pos="0" name="service.family" value="VM"/>
438
- <param pos="0" name="service.product" value="VM"/>
439
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
399
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
440
400
  <param pos="1" name="host.name"/>
441
401
  <param pos="2" name="service.version"/>
442
402
  <param pos="3" name="system.time"/>
@@ -453,57 +413,60 @@ The system or service fingerprint with the highest certainty overwrites the othe
453
413
  <param pos="0" name="service.product" value="IntraStore"/>
454
414
  <param pos="1" name="host.name"/>
455
415
  </fingerprint>
456
- <fingerprint pattern="^(\S+) E?SMTP Server \(JAMES E?SMTP Server ([\d\.]+)\) ready (\S{3}, \d{2} \S{3} \d{4} \d{2}:\d{2}:\d{2} \S+) \(\S+\)$">
416
+ <fingerprint pattern="^(\S+) E?SMTP Server \(JAMES E?SMTP Server ([\d\.]+)\) ready (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d) \(.+\)$">
457
417
  <description>JAMES SMTP Server</description>
458
- <example host.name="example.com" service.version="2.3.2">example.com SMTP Server (JAMES SMTP Server 2.3.2) ready Tue, 19 May 2015 00:36:13 +0200 (CEST)</example>
418
+ <example host.name="foo.bar" service.version="2.3.2">foo.bar SMTP Server (JAMES SMTP Server 2.3.2) ready Tue, 19 May 2015 00:36:13 +0200 (CEST)</example>
459
419
  <param pos="0" name="service.vendor" value="Apache"/>
460
420
  <param pos="0" name="service.product" value="James"/>
461
421
  <param pos="2" name="service.version"/>
462
422
  <param pos="1" name="host.name"/>
463
423
  <param pos="3" name="system.time"/>
464
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
424
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
465
425
  </fingerprint>
466
- <fingerprint pattern="^([^ ]+) \(Mail-Max Version (\d+\.\d+\.\d+\.\d+), (.+, .+)\) ESMTP Mail Server Ready. *$">
467
- <description>
468
- Mail Max (4 version numbers)
469
- example: 220 MAIL3 (Mail-Max Version 4.2.4.7, Wed, 31 Jan 2001 03:44:35 +0100 WST) ESMTP Mail Server Ready.
470
- </description>
471
- <param pos="0" name="service.vendor" value="Mail-Max"/>
472
- <param pos="0" name="service.family" value="Mail-Max"/>
473
- <param pos="0" name="service.product" value="Mail-Max"/>
474
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
426
+ <fingerprint pattern="^(?:(\S+) +)?ESMTP MailEnable Service, Version: ([\d.]+)$">
427
+ <description>MailEnable - Simple</description>
428
+ <example service.version="9.53">ESMTP MailEnable Service, Version: 9.53</example>
429
+ <param pos="0" name="os.vendor" value="Microsoft"/>
430
+ <param pos="0" name="os.family" value="Windows"/>
431
+ <param pos="0" name="os.product" value="Windows"/>
432
+ <param pos="0" name="service.vendor" value="MailEnable"/>
433
+ <param pos="0" name="service.family" value="Mail Server"/>
434
+ <param pos="0" name="service.product" value="Mail Server"/>
475
435
  <param pos="1" name="host.name"/>
476
436
  <param pos="2" name="service.version"/>
477
- <param pos="3" name="system.time"/>
478
437
  </fingerprint>
479
- <fingerprint pattern="^(\S+) E?SMTP MailEnable Service, Version: ([\d\.]+)-- ready at (\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2})$">
480
- <description>Simple MailEnable</description>
481
- <example host.name="example.com">example.com ESMTP MailEnable Service, Version: 1.8-- ready at 05/20/15 08:50:22</example>
438
+ <!-- MailEnable has an odd, three version string. Not sure about the meaning the second and third version #s. -->
439
+ <fingerprint pattern="^(?:(\S+) +)?ESMTP MailEnable Service, Version: (?:([\d.]+))?-[\d.]*-[\d.]* (?:ready|denied access) at (\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2})$">
440
+ <description>MailEnable - Complex</description>
441
+ <example host.name="foo.bar" service.version="1.8">foo.bar ESMTP MailEnable Service, Version: 1.8-- ready at 05/20/15 08:50:22</example>
442
+ <example host.name="foo.bar" service.version="9.53">foo.bar ESMTP MailEnable Service, Version: 9.53-9.53- ready at 11/30/17 00:57:37</example>
443
+ <example host.name="foo.bar" service.version="9.00" system.time="11/30/17 09:30:34">foo.bar ESMTP MailEnable Service, Version: 9.00--9.00 ready at 11/30/17 09:30:34</example>
444
+ <example host.name="foo.bar" service.version="1.986" system.time="04/05/18 16:15:25">foo.bar ESMTP MailEnable Service, Version: 1.986-- denied access at 04/05/18 16:15:25</example>
445
+ <param pos="0" name="os.vendor" value="Microsoft"/>
446
+ <param pos="0" name="os.family" value="Windows"/>
447
+ <param pos="0" name="os.product" value="Windows"/>
482
448
  <param pos="0" name="service.vendor" value="MailEnable"/>
483
- <param pos="0" name="service.family" value="MailEnable"/>
484
- <param pos="0" name="service.product" value="MailEnable"/>
449
+ <param pos="0" name="service.family" value="Mail Server"/>
450
+ <param pos="0" name="service.product" value="Mail Server"/>
485
451
  <param pos="0" name="system.time.format" value="MM/dd/yy HH:mm:ss"/>
486
452
  <param pos="1" name="host.name"/>
487
453
  <param pos="2" name="service.version"/>
488
454
  <param pos="3" name="system.time"/>
489
455
  </fingerprint>
490
- <fingerprint pattern="^([^ ]+) \(Mail-Max Version (\d+\.\d+), (.+, .+)\) ESMTP Mail Server Ready. *$">
491
- <description>
492
- Mail Max (2 version numbers)
493
- example: 220 WEBB (Mail-Max Version 3.065, Wed, 31 Jan 2001 03:46:11 +0100 WST) ESMTP Mail Server Ready.
494
- </description>
456
+ <fingerprint pattern="^([^ ]+) \(Mail-Max Version (\d+\.[\d\.]+), (.+, .+)\) ESMTP Mail Server Ready. *$">
457
+ <description>Mail Max</description>
458
+ <example host.name="foo.bar" service.version="4.2.4.7">foo.bar (Mail-Max Version 4.2.4.7, Wed, 31 Jan 2001 03:44:35 +0100 WST) ESMTP Mail Server Ready.</example>
459
+ <example host.name="foo.bar" service.version="3.073">foo.bar (Mail-Max Version 3.073, Thu, 30 Nov 2017 17:24:59 +0800 ) ESMTP Mail Server Ready.</example>
495
460
  <param pos="0" name="service.vendor" value="Mail-Max"/>
496
461
  <param pos="0" name="service.family" value="Mail-Max"/>
497
462
  <param pos="0" name="service.product" value="Mail-Max"/>
498
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
463
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
499
464
  <param pos="1" name="host.name"/>
500
465
  <param pos="2" name="service.version"/>
501
466
  <param pos="3" name="system.time"/>
502
467
  </fingerprint>
503
468
  <fingerprint pattern="^([^ ]+) +MailSite E?SMTP Receiver Version (\d+\.[\d.]+) Ready *$">
504
- <description>
505
- Rockliffe MailSite with version (http://www.rockliffe.com)
506
- </description>
469
+ <description>Rockliffe MailSite - with version (http://www.rockliffe.com)</description>
507
470
  <example host.name="foo.bar" service.version="3.4.6.0">foo.bar MailSite ESMTP Receiver Version 3.4.6.0 Ready</example>
508
471
  <example host.name="foo.bar" service.version="2.1.7">foo.bar MailSite SMTP Receiver Version 2.1.7 Ready</example>
509
472
  <param pos="0" name="service.vendor" value="Rockliffe"/>
@@ -513,9 +476,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
513
476
  <param pos="2" name="service.version"/>
514
477
  </fingerprint>
515
478
  <fingerprint pattern="^([^ ]+) +MailSite E?SMTP Receiver Ready *$">
516
- <description>
517
- Rockliffe MailSite without version (http://www.rockliffe.com)
518
- </description>
479
+ <description>Rockliffe MailSite - without version (http://www.rockliffe.com)</description>
519
480
  <example host.name="foo.bar">foo.bar MailSite SMTP Receiver Ready</example>
520
481
  <param pos="0" name="service.vendor" value="Rockliffe"/>
521
482
  <param pos="0" name="service.family" value="MailSite"/>
@@ -523,9 +484,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
523
484
  <param pos="1" name="host.name"/>
524
485
  </fingerprint>
525
486
  <fingerprint pattern="^ ?MailSite E?SMTP Receiver Version (\d+\.[\d.]+) Ready *$">
526
- <description>
527
- Rockliffe MailSite without hostname(http://www.rockliffe.com)
528
- </description>
487
+ <description>Rockliffe MailSite - without hostname (http://www.rockliffe.com)</description>
529
488
  <example service.version="10.2.0.0"> MailSite ESMTP Receiver Version 10.2.0.0 Ready</example>
530
489
  <param pos="0" name="service.vendor" value="Rockliffe"/>
531
490
  <param pos="0" name="service.family" value="MailSite"/>
@@ -533,10 +492,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
533
492
  <param pos="1" name="service.version"/>
534
493
  </fingerprint>
535
494
  <fingerprint pattern="^([^ ]+) +MAILsweeper ESMTP Receiver Version (\d\.[\d.]+) Ready *$">
536
- <description>
537
- Content Security MAILsweeper for SMTP http://www.contenttechnologies.com/products/msw4smtp/default.asp
538
- example: 220 infotech.at MAILsweeper ESMTP Receiver Version 4.2.1.0 Ready
539
- </description>
495
+ <description>Content Security MAILsweeper for SMTP (http://www.contenttechnologies.com/products/msw4smtp/default.asp)</description>
540
496
  <example service.version="4.2.1.0">foo.bar MAILsweeper ESMTP Receiver Version 4.2.1.0 Ready</example>
541
497
  <param pos="0" name="service.vendor" value="Clearswift"/>
542
498
  <param pos="0" name="service.family" value="MAILsweeper"/>
@@ -545,12 +501,12 @@ The system or service fingerprint with the highest certainty overwrites the othe
545
501
  <param pos="2" name="service.version"/>
546
502
  </fingerprint>
547
503
  <fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+) UNREGISTERED; *(.+) *$">
548
- <description>MDaemon mail server, with timestamp, unregistered</description>
504
+ <description>MDaemon mail server - with timestamp, unregistered</description>
549
505
  <example service.version="4.0.5">foo.bar ESMTP MDaemon 4.0.5 UNREGISTERED; Sat, 06 Oct 2001 09:10:56 +0400</example>
550
506
  <param pos="0" name="service.vendor" value="Alt-N"/>
551
507
  <param pos="0" name="service.family" value="MDaemon"/>
552
508
  <param pos="0" name="service.product" value="MDaemon"/>
553
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
509
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
554
510
  <param pos="0" name="mdaemon.unregistered" value="yes"/>
555
511
  <param pos="0" name="os.vendor" value="Microsoft"/>
556
512
  <param pos="0" name="os.family" value="Windows"/>
@@ -562,12 +518,12 @@ The system or service fingerprint with the highest certainty overwrites the othe
562
518
  <param pos="3" name="system.time"/>
563
519
  </fingerprint>
564
520
  <fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+); *(.+) *$">
565
- <description>MDaemon mail server, with timestamp</description>
521
+ <description>MDaemon mail server - with timestamp</description>
566
522
  <example service.version="4.0.2">foo.bar ESMTP MDaemon 4.0.2; Sat, 06 Oct 2001 01:46:44 -0500</example>
567
523
  <param pos="0" name="service.vendor" value="Alt-N"/>
568
524
  <param pos="0" name="service.family" value="MDaemon"/>
569
525
  <param pos="0" name="service.product" value="MDaemon"/>
570
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
526
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
571
527
  <param pos="0" name="os.vendor" value="Microsoft"/>
572
528
  <param pos="0" name="os.family" value="Windows"/>
573
529
  <param pos="0" name="os.device" value="General"/>
@@ -578,7 +534,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
578
534
  <param pos="3" name="system.time"/>
579
535
  </fingerprint>
580
536
  <fingerprint pattern="^([^ ]+) +ESMTP MDaemon ([^ ]+\.[^ ]+\.[^ ]+) ready *$">
581
- <description>MDaemon mail server, without timestamp</description>
537
+ <description>MDaemon mail server - without timestamp</description>
582
538
  <example service.version="3.5.7">foo.bar ESMTP MDaemon 3.5.7 ready</example>
583
539
  <param pos="0" name="service.vendor" value="Alt-N"/>
584
540
  <param pos="0" name="service.family" value="MDaemon"/>
@@ -592,9 +548,10 @@ The system or service fingerprint with the highest certainty overwrites the othe
592
548
  <param pos="2" name="service.version"/>
593
549
  </fingerprint>
594
550
  <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] (?:using )?MDaemon v(\d+\.[\d.]+) ([^ ]+) *$">
595
- <description>MDaemon mail server, with version revision</description>
551
+ <description>MDaemon mail server - with version revision</description>
596
552
  <example service.version="2.84" service.version.version="R">foo.bar ESMTP service ready [1] MDaemon v2.84 R</example>
597
553
  <example service.version="3.0.3" service.version.version="R">foo.bar ESMTP service ready [1] using MDaemon v3.0.3 R</example>
554
+ <example service.version="2.8.7.0" service.version.version="R">foo.bar ESMTP service ready [1] MDaemon v2.8.7.0 R</example>
598
555
  <param pos="0" name="service.vendor" value="Alt-N"/>
599
556
  <param pos="0" name="service.family" value="MDaemon"/>
600
557
  <param pos="0" name="service.product" value="MDaemon"/>
@@ -607,49 +564,10 @@ The system or service fingerprint with the highest certainty overwrites the othe
607
564
  <param pos="2" name="service.version"/>
608
565
  <param pos="3" name="service.version.version"/>
609
566
  </fingerprint>
610
- <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] MDaemon v([^ ]+\.[^ ]+) ([^ ]+) ([^ ]+) *$">
611
- <description>
612
- MDaemon mail server
613
- 220 foo.bar.com ESMTP service ready [1] MDaemon v2.7 SP5 R
614
- </description>
615
- <param pos="0" name="service.vendor" value="Alt-N"/>
616
- <param pos="0" name="service.family" value="MDaemon"/>
617
- <param pos="0" name="service.product" value="MDaemon"/>
618
- <param pos="0" name="os.vendor" value="Microsoft"/>
619
- <param pos="0" name="os.family" value="Windows"/>
620
- <param pos="0" name="os.device" value="General"/>
621
- <param pos="0" name="os.product" value="Windows"/>
622
- <param pos="0" name="os.arch" value="x86"/>
623
- <param pos="1" name="host.name"/>
624
- <param pos="2" name="service.version"/>
625
- <param pos="3" name="service.version.version"/>
626
- <param pos="4" name="service.version.version.version"/>
627
- </fingerprint>
628
- <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] MDaemon v([^ ]+)\.([^ ]+)\.([^ ]+)\.([^ ]+) ([^ ]+) *$">
629
- <description>
630
- MDaemon mail server
631
- 220 foo.bar.com ESMTP service ready [1] MDaemon v2.8.7.0 R
632
- </description>
633
- <param pos="0" name="service.vendor" value="Alt-N"/>
634
- <param pos="0" name="service.family" value="MDaemon"/>
635
- <param pos="0" name="service.product" value="MDaemon"/>
636
- <param pos="0" name="os.vendor" value="Microsoft"/>
637
- <param pos="0" name="os.family" value="Windows"/>
638
- <param pos="0" name="os.device" value="General"/>
639
- <param pos="0" name="os.product" value="Windows"/>
640
- <param pos="0" name="os.arch" value="x86"/>
641
- <param pos="1" name="host.name"/>
642
- <param pos="2" name="service.version"/>
643
- <param pos="3" name="service.version.version"/>
644
- <param pos="4" name="service.version.version.version"/>
645
- <param pos="5" name="service.version.version.version.version"/>
646
- <param pos="6" name="service.version.version.version.version.version"/>
647
- </fingerprint>
648
- <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] \(MDaemon v([^ ]+\.[^ ]+) ([^ ]+) ([^ ]+)\) *$">
649
- <description>
650
- MDaemon mail server
651
- 220 foo.bar.com ESMTP service ready [2] (MDaemon v2.7 SP4 R)
652
- </description>
567
+ <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] (?:\()?MDaemon v([\d.]+) ([^ ]+) ([^ )]+)(?:\))? *$">
568
+ <description>MDaemon mail server - with service pack</description>
569
+ <example service.version="2.7" service.version.version="SP5" service.version.version.version="R">foo.bar ESMTP service ready [1] MDaemon v2.7 SP5 R</example>
570
+ <example service.version="2.7" service.version.version="SP4" service.version.version.version="R">foo.bar ESMTP service ready [1] (MDaemon v2.7 SP4 R)</example>
653
571
  <param pos="0" name="service.vendor" value="Alt-N"/>
654
572
  <param pos="0" name="service.family" value="MDaemon"/>
655
573
  <param pos="0" name="service.product" value="MDaemon"/>
@@ -664,10 +582,8 @@ The system or service fingerprint with the highest certainty overwrites the othe
664
582
  <param pos="4" name="service.version.version.version"/>
665
583
  </fingerprint>
666
584
  <fingerprint pattern="^([^ ]+) +ESMTP service ready \[[0-9]+\] \(MDaemon v([^ ]+\.[^ ]+) ([^ ]+) ([^ ]+) ([^ ]+)\) *$">
667
- <description>
668
- MDaemon mail server
669
- 220 foo.bar.com ESMTP service ready [1] (MDaemon v2.5 rB b1 32-T)
670
- </description>
585
+ <description>MDaemon mail server</description>
586
+ <example service.version="2.5" service.version.version.version="b1">foo.bar ESMTP service ready [1] (MDaemon v2.5 rB b1 32-T)</example>
671
587
  <param pos="0" name="service.vendor" value="Alt-N"/>
672
588
  <param pos="0" name="service.family" value="MDaemon"/>
673
589
  <param pos="0" name="service.product" value="MDaemon"/>
@@ -683,42 +599,26 @@ The system or service fingerprint with the highest certainty overwrites the othe
683
599
  <param pos="5" name="service.version.version.version.version"/>
684
600
  </fingerprint>
685
601
  <!-- example: 220 mail.db-list.com ESMTP MERAK 3.00.140; Tue, 24 Jul 2001 21:30:47 -0700 -->
686
- <fingerprint pattern="^([^ ]+) +ESMTP MERAK ([^ ]+\.[^ ]+\.[^ ]+); *(.+) *$">
687
- <description>
688
- Merak mail server http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x)
689
- 220 mail.db-list.com ESMTP MERAK 3.00.140; Tue, 24 Jul 2001 21:30:47 -0700
690
- </description>
602
+ <fingerprint pattern="^([^ ]+) +E?SMTP (?i:MERAK) ([^ ]+\.[^ ]+\.[^ ]+); *(.+) *$">
603
+ <description>Merak mail server - http://www.icewarp.com/merakmail/ (runs on 2000/NT/9x)</description>
604
+ <example host.name="foo.bar" service.version="8.0.3">foo.bar SMTP Merak 8.0.3; Thu, 30 Nov 2017 20:01:41 +1000</example>
605
+ <example host.name="foo.bar" service.version="8.0.3">foo.bar ESMTP Merak 8.0.3; Thu, 30 Nov 2017 12:08:09 +0200</example>
606
+ <example host.name="foo.bar" service.version="2.10.284">foo.bar ESMTP MERAK 2.10.284; Thu, 30 Nov 2017 17:55:10 +0800</example>
691
607
  <param pos="0" name="service.vendor" value="Merak"/>
692
608
  <param pos="0" name="service.family" value="Mail Server"/>
693
609
  <param pos="0" name="service.product" value="Mail Server"/>
694
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
610
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
695
611
  <param pos="1" name="host.name"/>
696
612
  <param pos="2" name="service.version"/>
697
613
  <param pos="3" name="system.time"/>
698
614
  </fingerprint>
699
615
  <fingerprint pattern="^MERCUR SMTP-Server \(v([^ ]+\.[^ ])0\.([^ ]+) ([^ ]+)\) for (.+) ready at (.+) *$">
700
- <description>
701
- Atrium's MERCUR SMTP server
702
- http://www.atrium-software.com/pub/support_e.cfm
703
- example: 220 MERCUR SMTP-Server (v3.20.01 KA-0098304) for Windows NT ready at Tue, 6 Feb 2001 21:38:26 +0100
704
- example: 220 MERCUR SMTP-Server (v3.20.01 KA-0098304) for Windows NT ready at Tue, 6 Feb 2001 21:38:26 +0100
705
- example: 220 MERCUR SMTP-Server (v3.10.18 KA-0098307) for Windows NT ready at Tue, 6 Feb 2001 18:44:03 +0100
706
- example: 220 MERCUR SMTP-Server (v3.10.18 KA-0098316) for Windows NT ready at Tue, 6 Feb 2001 15:01:51 +0100
707
- example: 220 MERCUR SMTP-Server (v3.30.03 KA-0098319) for Windows NT ready at Tue, 6 Feb 2001 19:06:18 +0100
708
- example: 220 MERCUR SMTP-Server (v3.30.03 KA-5341199) for Windows NT ready at Tue, 6 Feb 2001 18:47:09 +0100
709
- example: 220 MERCUR SMTP-Server (v3.20.01 AS-0098307) for Windows NT ready at Tue, 6 Feb 2001 15:13:14 +0100
710
- example: 220 MERCUR SMTP-Server (v3.20.01 AS-0098309) for Windows NT ready at Tue, 6 Feb 2001 16:11:42 +0100
711
- example: 220 MERCUR SMTP-Server (v3.10.16 AS-7962628) for Windows 95 ready at Tue, 6 Feb 2001 16:37:38 +0100
712
- example: 220 MERCUR SMTP-Server (v3.10.18 AS-5341186) for Windows NT ready at Tue, 6 Feb 2001 19:27:24 +0100
713
- example: 220 MERCUR SMTP-Server (v3.30.03 CO-0098319) for Windows NT ready at Tue, 6 Feb 2001 20:45:01 +0100
714
- example: 220 MERCUR SMTP-Server (v3.30.01 NR-7864330) for Windows NT ready at Tue, 6 Feb 2001 21:31:18 +0100
715
- example: 220 MERCUR SMTP-Server (v3.30.03 DG-0098304) for Windows NT ready at Tue, 6 Feb 2001 22:52:50 +0100
716
- example: 220 MERCUR SMTP-Server (v3.20.01 SY-0098318) for Windows NT ready at Tue, 6 Feb 2001 23:26:22 +0100
717
- </description>
616
+ <description>Atrium's MERCUR SMTP server (http://www.atrium-software.com/pub/support_e.cfm)</description>
617
+ <example service.version="3.3" service.version.version="09" service.version.version.version="SA-0000005" mercur.os.info="Windows NT">MERCUR SMTP-Server (v3.30.09 SA-0000005) for Windows NT ready at Thu, 30 Nov 2017 10:01:06 +0100</example>
718
618
  <param pos="0" name="service.vendor" value="Atrium Software"/>
719
619
  <param pos="0" name="service.family" value="MERCUR"/>
720
620
  <param pos="0" name="service.product" value="MERCUR"/>
721
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
621
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
722
622
  <param pos="1" name="service.version"/>
723
623
  <param pos="2" name="service.version.version"/>
724
624
  <param pos="3" name="service.version.version.version"/>
@@ -726,9 +626,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
726
626
  <param pos="5" name="system.time"/>
727
627
  </fingerprint>
728
628
  <fingerprint pattern="^([^ ]+) Mercury ([^ ]+\.[^ ]+) ESMTP server ready.$">
729
- <description>
730
- Mercury NLM for Netware ( http://www.pmail.com/index.cfm )
731
- </description>
629
+ <description>Mercury NLM for Netware ( http://www.pmail.com/index.cfm )</description>
732
630
  <example service.version="1.43">foo.bar Mercury 1.43 ESMTP server ready.</example>
733
631
  <param pos="0" name="service.family" value="Mercury Mail Transport System"/>
734
632
  <param pos="0" name="service.product" value="Mercury Mail Transport System"/>
@@ -740,9 +638,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
740
638
  <param pos="2" name="service.version"/>
741
639
  </fingerprint>
742
640
  <fingerprint pattern="^^([^ ]+) Mercury\/32 v([^ ]+\.[^ ]+) (?:SMTP\/)?ESMTP server ready.?$">
743
- <description>
744
- Mercury/32 for Win9x/NT/2000 ( http://www.pmail.com/index.cfm )
745
- </description>
641
+ <description>Mercury/32 for Win9x/NT/2000 ( http://www.pmail.com/index.cfm )</description>
746
642
  <example service.version="3.01a">foo.bar Mercury/32 v3.01a SMTP/ESMTP server ready.</example>
747
643
  <example service.version="3.30">foo.bar Mercury/32 v3.30 ESMTP server ready.</example>
748
644
  <param pos="0" name="service.family" value="Mercury Mail Transport System"/>
@@ -755,25 +651,19 @@ The system or service fingerprint with the highest certainty overwrites the othe
755
651
  <param pos="2" name="service.version"/>
756
652
  </fingerprint>
757
653
  <fingerprint pattern="^([^ ]+) SMTP NAVIEG ([^ ]+\.[^ ]+\.[^ ]+); (.+)* http.*$">
758
- <description>
759
- Norton Antivirus for Internet Email Gateways
760
- (note the product changed its name from "Norton Antivirus for Internet Email Gateways" (NAVIEG) to
761
- "Norton Antivirus for Gateways" (NAVGW) as of version 2.1
762
- example: mailman.laughlin.af.mil SMTP NAVIEG 2.0.1; Sun, 29 Jul 2001 22:02:16 -0500 http://www.symantec.com
763
- </description>
654
+ <description>Norton Antivirus for Internet Email Gateways (becomes NAVGW in 2.1)</description>
655
+ <example host.name="foo.bar" service.version="2.0.1">foo.bar SMTP NAVIEG 2.0.1; Sun, 29 Jul 2001 22:02:16 -0500 http://www.symantec.com</example>
764
656
  <param pos="0" name="service.vendor" value="Norton"/>
765
657
  <param pos="0" name="service.family" value="Antivirus for Gateways"/>
766
658
  <param pos="0" name="service.product" value="Antivirus for Gateways"/>
767
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
659
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
768
660
  <param pos="1" name="host.name"/>
769
661
  <param pos="2" name="service.version"/>
770
662
  <param pos="3" name="system.time"/>
771
663
  </fingerprint>
772
664
  <fingerprint pattern="^([^ ]+) ESMTP service \(Netscape Messaging Server ([^ ]+\.[^ ]+) Patch ([^ ]+).*$">
773
- <description>
774
- Netscape Messaging Server
775
- example: 220 mail.iasmail.net ESMTP service (Netscape Messaging Server 4.15 Patch 2 (built May 30 2000))
776
- </description>
665
+ <description>Netscape Messaging Server - with patch number</description>
666
+ <example host.name="foo.bar" service.version="4.15" service.version.version="7">foo.bar ESMTP service (Netscape Messaging Server 4.15 Patch 7 (built Sep 12 2001))</example>
777
667
  <param pos="0" name="service.vendor" value="Netscape"/>
778
668
  <param pos="0" name="service.family" value="Messaging Server"/>
779
669
  <param pos="0" name="service.product" value="Messaging Server"/>
@@ -781,75 +671,64 @@ The system or service fingerprint with the highest certainty overwrites the othe
781
671
  <param pos="2" name="service.version"/>
782
672
  <param pos="3" name="service.version.version"/>
783
673
  </fingerprint>
784
- <fingerprint pattern="^([^ ]+) ESMTP service \(Netscape Messaging Server ([^ ]+\.[^ ]+)\) ready (.+)$">
785
- <description>
786
- Netscape Messaging Server
787
- </description>
674
+ <fingerprint pattern="^([^ ]+) ESMTP server \(Netscape Messaging Server - Version ([\d.]+)\) ready (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d) *$">
675
+ <description>Netscape Messaging Server - w/o patch number</description>
676
+ <example host.name="foo.bar" service.version="3.6" system.time="Thu, 30 Nov 2017 04:19:10 -0500">foo.bar ESMTP server (Netscape Messaging Server - Version 3.6) ready Thu, 30 Nov 2017 04:19:10 -0500</example>
788
677
  <param pos="0" name="service.vendor" value="Netscape"/>
789
678
  <param pos="0" name="service.family" value="Messaging Server"/>
790
679
  <param pos="0" name="service.product" value="Messaging Server"/>
791
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
680
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
792
681
  <param pos="1" name="host.name"/>
793
682
  <param pos="2" name="service.version"/>
794
683
  <param pos="3" name="system.time"/>
795
684
  </fingerprint>
796
685
  <fingerprint pattern="^([^ ]+) Lotus SMTP MTA Service Ready *$">
797
- <description>
798
- Lotus Notes 4 SMTP MTA
799
- </description>
686
+ <description>Lotus Notes 4 SMTP MTA</description>
687
+ <example host.name="foo.bar">foo.bar Lotus SMTP MTA Service Ready</example>
800
688
  <param pos="0" name="service.vendor" value="Lotus"/>
801
689
  <param pos="0" name="service.family" value="Lotus Domino"/>
802
690
  <param pos="0" name="service.product" value="Lotus Domino"/>
803
691
  <param pos="0" name="service.version" value="4"/>
804
692
  <param pos="1" name="host.name"/>
805
693
  </fingerprint>
806
- <fingerprint pattern="^([^ ]+) ESMTP Service \(Lotus Domino Release (\d+\.\d+\.\w+)\) ready at (.+) *$">
694
+ <!-- Branding is muddy here, IBM bought Lotus in 1995, server product wasn't
695
+ named Domino until Dec 1996 w/ v 4.5. Seems to have started being
696
+ called IBM Domino as of v9.0 on product and in banners.
697
+ -->
698
+ <fingerprint pattern="^ ?(?:([^ ]+))? *ESMTP Service \(Lotus Domino Release (\d+\.[\w.]+(?: FP\d+)?(?: HF\d+)?)(?: \(Intl\))?\) ready at (.+) *$">
807
699
  <description>Lotus Domino SMTP MTA</description>
808
- <example service.version="5.0.8">foo.bar ESMTP Service (Lotus Domino Release 5.0.8) ready at Thu, 16 Nov 2017 18:14:12 +0900</example>
809
- <example service.version="5.0.13a">foo.bar ESMTP Service (Lotus Domino Release 5.0.13a) ready at Thu, 16 Nov 2017 17:47:42 +0800</example>
810
- <example service.version="7.0.4">foo.bar ESMTP Service (Lotus Domino Release 7.0.4) ready at Thu, 16 Nov 2017 18:28:36 +0900</example>
700
+ <example service.version="8.5">foo.bar ESMTP Service (Lotus Domino Release 8.5) ready at Thu, 30 Nov 2017 17:01:45 +0800</example>
701
+ <example service.version="8.5.3FP6 HF1944">foo.bar ESMTP Service (Lotus Domino Release 8.5.3FP6 HF1944) ready at Thu, 30 Nov 2017 17:17:43 +0800</example>
702
+ <example service.version="8.0.2 FP1 HF82">foo.bar ESMTP Service (Lotus Domino Release 8.0.2 FP1 HF82) ready at Thu, 5 Apr 2018 22:03:28 +0200</example>
703
+ <example service.version="5.0.13a"> foo.bar ESMTP Service (Lotus Domino Release 5.0.13a) ready at Thu, 16 Nov 2017 17:47:42 +0800</example>
704
+ <example service.version="7.0.4">foo.bar ESMTP Service (Lotus Domino Release 7.0.4) ready at Thu, 16 Nov 2017 18:28:36 +0900</example>
811
705
  <example service.version="8.0.2FP2">foo.bar ESMTP Service (Lotus Domino Release 8.0.2FP2) ready at Thu, 16 Nov 2017 02:17:33 -0700</example>
812
706
  <example service.version="8.5.3">foo.bar ESMTP Service (Lotus Domino Release 8.5.3) ready at Thu, 16 Nov 2017 17:52:21 +0800</example>
813
- <param pos="0" name="service.vendor" value="Lotus"/>
814
- <param pos="0" name="service.family" value="Lotus Domino"/>
815
- <param pos="0" name="service.product" value="Lotus Domino"/>
816
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
817
- <param pos="1" name="host.name"/>
818
- <param pos="2" name="service.version"/>
819
- <param pos="3" name="system.time"/>
820
- </fingerprint>
821
- <fingerprint pattern="^([^ ]+) ESMTP Service \(Lotus Domino Release (\d+\.\w+)\) ready at (.+) *$">
822
- <description>
823
- Lotus Domino 5 SMTP MTA
824
- example: 220 foo.bar.com ESMTP Service (Lotus Domino Release 5.0a) ready at Wed, 20 Jun 2001 08:59:17 +0200
825
- </description>
826
- <param pos="0" name="service.vendor" value="Lotus"/>
707
+ <example service.version="7.0"> ESMTP Service (Lotus Domino Release 7.0) ready at Thu, 30 Nov 2017 17:00:41 +0800</example>
708
+ <example host.name="foo.bar" service.version="5.0.1">foo.bar ESMTP Service (Lotus Domino Release 5.0.1 (Intl)) ready at Thu, 30 Nov 2017 12:38:43 +0300</example>
709
+ <param pos="0" name="service.vendor" value="IBM"/>
827
710
  <param pos="0" name="service.family" value="Lotus Domino"/>
828
711
  <param pos="0" name="service.product" value="Lotus Domino"/>
829
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
712
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
830
713
  <param pos="1" name="host.name"/>
831
714
  <param pos="2" name="service.version"/>
832
715
  <param pos="3" name="system.time"/>
833
716
  </fingerprint>
834
- <fingerprint pattern="^([^ ]+) ESMTP Service \(Lotus Domino Release (\d+\.\d+\.\w+) \(Intl\)\) ready at (.+) *$">
835
- <description>
836
- Lotus Domino 5 SMTP MTA, International product version
837
- example: 220 foo.bar.com ESMTP Service (Lotus Domino Release 5.0.5 (Intl)) ready at Tue, 6 Feb 2001 18:54:23 -0500
838
- </description>
839
- <param pos="0" name="service.vendor" value="Lotus"/>
840
- <param pos="0" name="service.family" value="Lotus Domino"/>
841
- <param pos="0" name="service.product" value="Lotus Domino"/>
842
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
843
- <param pos="0" name="notes.intl" value="yes"/>
717
+ <fingerprint pattern="^ ?(?:([^ ]+))? *ESMTP Service \(IBM Domino Release (\d+\.[\w.]+(?: HF\d+)?)\) ready at (.+) *$">
718
+ <description>IBM Domino SMTP MTA</description>
719
+ <example host.name="foo.bar" service.version="9.0.1FP8 HF475">foo.bar ESMTP Service (IBM Domino Release 9.0.1FP8 HF475) ready at Thu, 30 Nov 2017 17:55:48 +0900</example>
720
+ <example host.name="foo.bar" service.version="9.0.1"> foo.bar ESMTP Service (IBM Domino Release 9.0.1) ready at Thu, 30 Nov 2017 10:12:26 +0100</example>
721
+ <example service.version="9.0.1FP8"> ESMTP Service (IBM Domino Release 9.0.1FP8) ready at Thu, 30 Nov 2017 13:51:59 -0800</example>
722
+ <param pos="0" name="service.vendor" value="IBM"/>
723
+ <param pos="0" name="service.family" value="IBM Domino"/>
724
+ <param pos="0" name="service.product" value="IBM Domino"/>
725
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
844
726
  <param pos="1" name="host.name"/>
845
727
  <param pos="2" name="service.version"/>
846
728
  <param pos="3" name="system.time"/>
847
729
  </fingerprint>
848
730
  <fingerprint pattern="^([^ ]+) ESMTP Service \(Lotus Domino Build (V?[\w.]+)\) ready at (.+) *$">
849
- <description>
850
- Lotus Domino (some early build)
851
- 220 foo.bar.com ESMTP Service (Lotus Domino Build 166.1) ready at Tue, 6 Feb 2001 2
852
- </description>
731
+ <description>Lotus Domino (some early build)</description>
853
732
  <example notes.build.version="166.1">foo.bar ESMTP Service (Lotus Domino Build 166.1) ready at Thu, 16 Nov 2017 10:39:22 +0200</example>
854
733
  <example notes.build.version="V85_M2_08202008">foo.bar ESMTP Service (Lotus Domino Build V85_M2_08202008) ready at Thu, 16 Nov 2017 03:57:40 -0500</example>
855
734
  <param pos="0" name="service.vendor" value="Lotus"/>
@@ -860,23 +739,18 @@ The system or service fingerprint with the highest certainty overwrites the othe
860
739
  <param pos="3" name="system.time"/>
861
740
  </fingerprint>
862
741
  <fingerprint pattern="^Lotus Notes ESMTP Server X[^ ]+\.[^ ]+ on (.+) ready at (.+)\. *$">
863
- <description>
864
- Lotus Notes 4.x with SMTP MTA add-on
865
- 220 Lotus Notes ESMTP Server X1.0 on RedSox R45 Server/Red Sox/US ready at Fri, 15 Feb 2002 09:46:19 -0800.
866
- </description>
742
+ <description>Lotus Notes 4.x with SMTP MTA add-on</description>
743
+ <example host.name="FooBar R45 Server/Foo Bar/US" system.time="Fri, 15 Feb 2002 09:46:19 -0800">Lotus Notes ESMTP Server X1.0 on FooBar R45 Server/Foo Bar/US ready at Fri, 15 Feb 2002 09:46:19 -0800.</example>
867
744
  <param pos="0" name="service.vendor" value="Lotus"/>
868
745
  <param pos="0" name="service.family" value="Lotus Domino"/>
869
746
  <param pos="0" name="service.product" value="Lotus Domino"/>
870
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
747
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
871
748
  <param pos="1" name="host.name"/>
872
749
  <param pos="2" name="system.time"/>
873
750
  </fingerprint>
874
751
  <fingerprint pattern="^([^ ]+) NTMail \(v(\d+\.\d+\.\d+)/([^ ]+)\) ready for ESMTP transfer *$">
875
- <description>
876
- NTMail http://www.gordano.com
877
- example: 220 lilzmail.liwest.at NTMail (v4.30.0012/NU2182.02.1cf87970) ready for ESMTP transfer
878
- example: 220 pluto.wvwc.edu NTMail (v5.06.0016/NT9445.00.28cc9615) ready for ESMTP transfer
879
- </description>
752
+ <description>NTMail (http://www.gordano.com)</description>
753
+ <example host.name="foo.bar" service.version="7.02.3037" ntmail.id="NU1319.01.5b000000">foo.bar NTMail (v7.02.3037/NU1319.01.5b000000) ready for ESMTP transfer </example>
880
754
  <param pos="0" name="service.vendor" value="Gordano"/>
881
755
  <param pos="0" name="service.family" value="NTMail"/>
882
756
  <param pos="0" name="service.product" value="NTMail"/>
@@ -885,20 +759,12 @@ The system or service fingerprint with the highest certainty overwrites the othe
885
759
  <param pos="3" name="ntmail.id"/>
886
760
  </fingerprint>
887
761
  <fingerprint pattern="^([^ ]+) WindowsNT SMTP Server v([^ ]+\.[^ ]+\.[^ ]+)/([^ ]+)/SP ESMTP ready at (.+) *$">
888
- <description>
889
- versions 3.x and earlier of NTMail http://www.gordano.com (it was called Internet Shopper's something or other)
890
- example: 220 mail.Networkengineering WindowsNT SMTP Server v3.03.0018/1.aio1/SP ESMTP ready at Wed, 25 Jul 2001 23:03:11 -0400
891
- example: 220 mars.wvwc.edu WindowsNT SMTP Server v3.03.0018/1.ajhf/SP ESMTP ready at Thu, 29 Oct 1998 18:01:30 -0500
892
- example: 220 mail.someisp.net WindowsNT SMTP Server v3.03.0017/1.aihl/SP ESMTP ready at Sun, 6 Jun 1999 10:39:30 -0400
893
- example: 220 nt03s02.switchlink.be WindowsNT SMTP Server v3.03.0014/1.aiss/SP ESMTP ready at Fri, 17 Apr 1998 16:59:04 +0100
894
- example: 220 www.afsc.org WindowsNT SMTP Server v3.03.0017/1.abkz/SP ESMTP ready at Mon, 2 Oct 2000 11:50:29 -0400
895
- example: 220 wwmerchant.osopinion.com WindowsNT SMTP Server v3.03.0017/4c.adur/SP ESMTP ready at Fri, 26 Mar 1999 13:20:30 -0700
896
- example: 220 digital-hoon.tecdm.dmi.co.kr WindowsNT SMTP Server v3.02.07/2c.aaaj ready at Thu, 5 Dec 1996 22:46:12 +0000
897
- </description>
762
+ <description>NTMail - versions 3.x and earlier (it was called Internet Shopper's something or other)</description>
763
+ <example host.name="foo.bar" service.version="3.03.0018" ntmail.id="7.aavn">foo.bar WindowsNT SMTP Server v3.03.0018/7.aavn/SP ESMTP ready at Thu, 30 Nov 2017 10:15:31 +0100</example>
898
764
  <param pos="0" name="service.vendor" value="Gordano"/>
899
765
  <param pos="0" name="service.family" value="NTMail"/>
900
766
  <param pos="0" name="service.product" value="NTMail"/>
901
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
767
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
902
768
  <param pos="1" name="host.name"/>
903
769
  <param pos="2" name="service.version"/>
904
770
  <param pos="3" name="ntmail.id"/>
@@ -906,10 +772,10 @@ The system or service fingerprint with the highest certainty overwrites the othe
906
772
  </fingerprint>
907
773
  <fingerprint pattern="^(\S+)(?: UCX)? V\S+, OpenVMS V(\S+) (\S+) ready at .*$">
908
774
  <description>Some unknown mail server on OpenVMS</description>
909
- <example host.name="example.com" os.arch="IA64" os.version="8.4">example.com V5.7-ECO4, OpenVMS V8.4 IA64 ready at Wed, 20 May 2015 01:22:32 +0100 (BST)</example>
910
- <example host.name="example.com" os.arch="Alpha" os.version="7.3-2">example.com V5.4-15E, OpenVMS V7.3-2 Alpha ready at Wed, 20 May 2015 01:22:18 +0100 (BST)</example>
911
- <example host.name="example.com" os.arch="VAX" os.version="6.2">example.com UCX V4.2-21I, OpenVMS V6.2 VAX ready at Wed, 20 May 2015 01:15:16 GMT</example>
912
- <example host.name="example.com" os.arch="Alpha" os.version="6.2-1H3">example.com UCX V4.2-21I, OpenVMS V6.2-1H3 Alpha ready at Wed, 20 May 2015 00:55:37 GMT</example>
775
+ <example host.name="foo.bar" os.arch="IA64" os.version="8.4">foo.bar V5.7-ECO4, OpenVMS V8.4 IA64 ready at Wed, 20 May 2015 01:22:32 +0100 (BST)</example>
776
+ <example host.name="foo.bar" os.arch="Alpha" os.version="7.3-2">foo.bar V5.4-15E, OpenVMS V7.3-2 Alpha ready at Wed, 20 May 2015 01:22:18 +0100 (BST)</example>
777
+ <example host.name="foo.bar" os.arch="VAX" os.version="6.2">foo.bar UCX V4.2-21I, OpenVMS V6.2 VAX ready at Wed, 20 May 2015 01:15:16 GMT</example>
778
+ <example host.name="foo.bar" os.arch="Alpha" os.version="6.2-1H3">foo.bar UCX V4.2-21I, OpenVMS V6.2-1H3 Alpha ready at Wed, 20 May 2015 00:55:37 GMT</example>
913
779
  <param pos="1" name="host.name"/>
914
780
  <param pos="0" name="os.vendor" value="HP"/>
915
781
  <param pos="0" name="os.family" value="OpenVMS"/>
@@ -918,20 +784,19 @@ The system or service fingerprint with the highest certainty overwrites the othe
918
784
  <param pos="2" name="os.version"/>
919
785
  <param pos="3" name="os.arch"/>
920
786
  </fingerprint>
921
- <fingerprint pattern="^(\S+) E?SMTP PMailServer(?: \[Free Edition\]) ([\d\.]+); (\S{3}, \d{2} \S{3} \d{4} \d{2}:\d{2}:\d{2})$">
787
+ <fingerprint pattern="^(\S+) E?SMTP PMailServer(?: \[Free Edition\])? ([\d\.]+); (\w\w\w, +\d+ \w\w\w \d\d\d\d [\d:]+)$">
922
788
  <description>A.K.I PMail</description>
923
- <example host.name="example.com" service.version="1.91">example.com ESMTP PMailServer [Free Edition] 1.91; Fri, 22 May 2015 02:04:56</example>
789
+ <example host.name="foo.bar" service.version="1.91">foo.bar ESMTP PMailServer [Free Edition] 1.91; Fri, 22 May 2015 02:04:56</example>
790
+ <example host.name="foo.bar" service.version="1.78">foo.bar ESMTP PMailServer 1.78; Fri, 6 Apr 2018 04:34:11</example>
924
791
  <param pos="0" name="service.vendor" value="A.K.I Software"/>
925
792
  <param pos="0" name="service.product" value="PMail Server"/>
926
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss"/>
793
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss"/>
927
794
  <param pos="1" name="host.name"/>
928
795
  <param pos="2" name="service.version"/>
929
796
  <param pos="3" name="system.time"/>
930
797
  </fingerprint>
931
798
  <fingerprint pattern="^([^ ]+) Postfix \(Postfix-([^ ]+)-([^ ]+)\) \(([^ ]+)\) *$">
932
- <description>
933
- Postfix (2 version ids, followed by os)
934
- </description>
799
+ <description>Postfix - version + build, followed by os</description>
935
800
  <param pos="0" name="service.family" value="Postfix"/>
936
801
  <param pos="0" name="service.product" value="Postfix"/>
937
802
  <param pos="1" name="host.name"/>
@@ -939,20 +804,17 @@ The system or service fingerprint with the highest certainty overwrites the othe
939
804
  <param pos="3" name="service.version.version"/>
940
805
  <param pos="4" name="postfix.os.info"/>
941
806
  </fingerprint>
942
- <fingerprint pattern="^([^ ]+) ESMTP Postfix \(Postfix-([^ ]+)-([^ ]+)\) *$">
943
- <description>
944
- Postfix (2 version numbers)
945
- </description>
807
+ <fingerprint pattern="^([^ ]+) ESMTP Postfix \(?([\d.]+)\)?$">
808
+ <description>Postfix - Std semantic versioning, w/ optional parens</description>
809
+ <example service.version="3.1.4">foo.bar ESMTP Postfix (3.1.4)</example>
810
+ <example service.version="2.7.1">foo.bar ESMTP Postfix 2.7.1</example>
946
811
  <param pos="0" name="service.family" value="Postfix"/>
947
812
  <param pos="0" name="service.product" value="Postfix"/>
948
813
  <param pos="1" name="host.name"/>
949
814
  <param pos="2" name="service.version"/>
950
- <param pos="3" name="service.version.version"/>
951
815
  </fingerprint>
952
- <fingerprint pattern="^([^ ]+) ESMTP Postfix \(([\d.]+)-([^ ]+)\)$">
953
- <description>
954
- Postfix (2 version numbers )
955
- </description>
816
+ <fingerprint pattern="^([^ ]+) ESMTP Postfix \((?:Postfix-)?([\d.]+)-([^ ]+)\)$">
817
+ <description>Postfix - version + build</description>
956
818
  <example service.version="2.8" service.version.version="20100306">foo.bar ESMTP Postfix (2.8-20100306)</example>
957
819
  <param pos="0" name="service.family" value="Postfix"/>
958
820
  <param pos="0" name="service.product" value="Postfix"/>
@@ -960,21 +822,21 @@ The system or service fingerprint with the highest certainty overwrites the othe
960
822
  <param pos="2" name="service.version"/>
961
823
  <param pos="3" name="service.version.version"/>
962
824
  </fingerprint>
963
- <fingerprint pattern="^([^ ]+) Postfix \(Postfix-([^ ]+)\) \(([^ ]+)\) *$">
964
- <description>
965
- Postfix (1 version number)
966
- </description>
825
+ <fingerprint pattern="^([^ ]+) +E?SMTP Postfix \(Ubuntu\)$">
826
+ <description>Postfix - Ubuntu</description>
827
+ <example>foo.bar ESMTP Postfix (Ubuntu)</example>
967
828
  <param pos="0" name="service.family" value="Postfix"/>
968
829
  <param pos="0" name="service.product" value="Postfix"/>
969
830
  <param pos="1" name="host.name"/>
970
- <param pos="2" name="service.version"/>
971
- <param pos="3" name="postfix.os.info"/>
831
+ <param pos="0" name="os.vendor" value="Ubuntu"/>
832
+ <param pos="0" name="os.device" value="General"/>
833
+ <param pos="0" name="os.family" value="Linux"/>
834
+ <param pos="0" name="os.product" value="Linux"/>
972
835
  </fingerprint>
973
- <fingerprint pattern="^([^ ]+) E?SMTP Postfix \(Ubuntu\)$">
974
- <description>
975
- Postfix Ubuntu package.
976
- </description>
977
- <example>foo.bar.com ESMTP Postfix (Ubuntu)</example>
836
+ <fingerprint pattern="^([^ ]+)(?: ESMTP)? Hi, I'm a Mail-in-a-Box \(Ubuntu/Postfix; see https://mailinabox.email/\)$">
837
+ <description>Postfix - Ubuntu, Mail-in-a-Box package</description>
838
+ <example>foo.bar ESMTP Hi, I'm a Mail-in-a-Box (Ubuntu/Postfix; see https://mailinabox.email/)</example>
839
+ <example>foo.bar Hi, I'm a Mail-in-a-Box (Ubuntu/Postfix; see https://mailinabox.email/)</example>
978
840
  <param pos="0" name="service.family" value="Postfix"/>
979
841
  <param pos="0" name="service.product" value="Postfix"/>
980
842
  <param pos="1" name="host.name"/>
@@ -983,11 +845,9 @@ The system or service fingerprint with the highest certainty overwrites the othe
983
845
  <param pos="0" name="os.family" value="Linux"/>
984
846
  <param pos="0" name="os.product" value="Linux"/>
985
847
  </fingerprint>
986
- <fingerprint pattern="^([^ ]+) E?SMTP Postfix \(Debian/GNU\)$">
987
- <description>
988
- Postfix Debian package.
989
- </description>
990
- <example>foo.bar.com ESMTP Postfix (Debian/GNU)</example>
848
+ <fingerprint pattern="^([^ ]+) +E?SMTP Postfix \(Debian/GNU\)$">
849
+ <description>Postfix - Debian</description>
850
+ <example>foo.bar ESMTP Postfix (Debian/GNU)</example>
991
851
  <param pos="0" name="service.family" value="Postfix"/>
992
852
  <param pos="0" name="service.product" value="Postfix"/>
993
853
  <param pos="1" name="host.name"/>
@@ -997,50 +857,40 @@ The system or service fingerprint with the highest certainty overwrites the othe
997
857
  <param pos="0" name="os.product" value="Linux"/>
998
858
  </fingerprint>
999
859
  <fingerprint pattern="^([^ ]+) ESMTP.* Postfix *\(.+\) *$">
1000
- <description>
1001
- Generic Postfix banner with amusing comments in parentheses
1002
- </description>
1003
- <example>foo.bar.com ESMTP Postfix (lol)</example>
860
+ <description>Postfix - generic banner with amusing comments in parentheses</description>
861
+ <example>foo.bar ESMTP Postfix (lol)</example>
1004
862
  <param pos="0" name="service.family" value="Postfix"/>
1005
863
  <param pos="0" name="service.product" value="Postfix"/>
1006
864
  <param pos="1" name="host.name"/>
1007
865
  </fingerprint>
1008
- <fingerprint pattern="^([^ ]+) ESMTP.* Postfix *$">
1009
- <description>
1010
- Generic Postfix banner.
1011
- </description>
1012
- <example>foo.bar.com ESMTP Postfix</example>
866
+ <fingerprint pattern="^(?i)([^ ]+) +E?SMTP.* Postfix *$">
867
+ <description>Postfix - generic banner</description>
868
+ <example>foo.bar ESMTP Postfix</example>
869
+ <example>foo.bar SMTP Postfix</example>
1013
870
  <param pos="0" name="service.family" value="Postfix"/>
1014
871
  <param pos="0" name="service.product" value="Postfix"/>
1015
872
  <param pos="1" name="host.name"/>
1016
873
  </fingerprint>
1017
- <fingerprint pattern="^ESMTP Postfix$">
1018
- <description>Postfix banner without hostname or version</description>
874
+ <fingerprint pattern="^ *ESMTP Postfix$">
875
+ <description>Postfix - banner without hostname or version</description>
1019
876
  <example>ESMTP Postfix</example>
1020
877
  <param pos="0" name="service.family" value="Postfix"/>
1021
878
  <param pos="0" name="service.product" value="Postfix"/>
1022
879
  </fingerprint>
1023
- <fingerprint pattern="^([^ ]+) ESMTP server \(Post\.Office v([^ ]+) release (.+) ID# ([^ ]+)\) ready (.+) *$">
1024
- <description>
1025
- Post.Office (3 version numbers)
1026
- </description>
1027
- <example host.name="192.168.1.1" service.version="3.1" postoffice.build="PO205e" postoffice.id="0-42000U100L2S100" system.time="Tue, 6 Feb 2001 19:38:32 +0100">192.168.1.1 ESMTP server (Post.Office v3.1 release PO205e ID# 0-42000U100L2S100) ready Tue, 6 Feb 2001 19:38:32 +0100</example>
1028
- <param pos="0" name="service.family" value="Post.Office"/>
1029
- <param pos="0" name="service.product" value="Post.Office"/>
1030
- <param pos="2" name="service.version"/>
1031
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
880
+ <fingerprint pattern="^(?i)((?!ESMTP)[^ ]+) POSTFIX$">
881
+ <description>Postfix - generic w/o ESMTP</description>
882
+ <example host.name="foo.bar">foo.bar Postfix</example>
883
+ <param pos="0" name="service.family" value="Postfix"/>
884
+ <param pos="0" name="service.product" value="Postfix"/>
1032
885
  <param pos="1" name="host.name"/>
1033
- <param pos="3" name="postoffice.build"/>
1034
- <param pos="4" name="postoffice.id"/>
1035
- <param pos="5" name="system.time"/>
1036
886
  </fingerprint>
1037
- <fingerprint pattern="^([^ ]+) ESMTP server \(P|post\.O|office v([^ ]+\.[^ ]+) (.+) ID# ([^ ]+)\) ready (.+) *$">
1038
- <description>
1039
- Post.Office lacking word "release" before release tag
1040
- </description>
887
+ <fingerprint pattern="^([^ ]+) ESMTP server \((?i:P)ost\.(?i:O)ffice v([^ ]+\.[^ ]+)(?: release)? (.+) ID# ([^ ]+)\) ready (.+) *$">
888
+ <description>Post.Office</description>
889
+ <example host.name="foo.bar" service.version="3.8.4" postoffice.build="116" postoffice.id="1001-65749U100L10S0V38" system.time="Thu, 30 Nov 2017 18:46:24 +0900">foo.bar ESMTP server (post.office v3.8.4 release 116 ID# 1001-65749U100L10S0V38) ready Thu, 30 Nov 2017 18:46:24 +0900</example>
890
+ <example host.name="foo.bar" service.version="3.1" postoffice.build="PO205e" postoffice.id="0-42000U100L2S100" system.time="Tue, 6 Feb 2001 19:38:32 +0100">foo.bar ESMTP server (Post.Office v3.1 release PO205e ID# 0-42000U100L2S100) ready Tue, 6 Feb 2001 19:38:32 +0100</example>
1041
891
  <param pos="0" name="service.family" value="Post.Office"/>
1042
892
  <param pos="0" name="service.product" value="Post.Office"/>
1043
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
893
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1044
894
  <param pos="1" name="host.name"/>
1045
895
  <param pos="2" name="service.version"/>
1046
896
  <param pos="3" name="postoffice.build"/>
@@ -1048,44 +898,44 @@ The system or service fingerprint with the highest certainty overwrites the othe
1048
898
  <param pos="5" name="system.time"/>
1049
899
  </fingerprint>
1050
900
  <fingerprint pattern="^([^ ]+) Generic SMTP handler *$">
1051
- <description>
1052
- Raptor Firewall
1053
- example: 220 foo.bar.com Generic SMTP handler
1054
- </description>
901
+ <description>Raptor Firewall (low confidence)</description>
902
+ <example host.name="foo.bar">foo.bar Generic SMTP handler</example>
1055
903
  <param pos="0" name="service.product" value="raptor"/>
1056
904
  <param pos="1" name="host.name"/>
1057
905
  </fingerprint>
1058
906
  <fingerprint pattern="^(\S+) SAP (\S+) E?SMTP service ready$">
1059
907
  <description>SAP SMTP Server</description>
1060
- <example host.name="example.com" service.version="8.04(53)">example.com SAP 8.04(53) ESMTP service ready</example>
908
+ <example host.name="foo.bar" service.version="8.04(53)">foo.bar SAP 8.04(53) ESMTP service ready</example>
1061
909
  <param pos="0" name="service.vendor" value="SAP"/>
1062
910
  <param pos="0" name="service.product" value="SMTP"/>
1063
911
  <param pos="2" name="service.version"/>
1064
912
  <param pos="1" name="host.name"/>
1065
913
  </fingerprint>
914
+ <fingerprint pattern="^Sendmail ESMTP ready$">
915
+ <description>Sendmail - short banner w/o hostname, version, platform, or date.</description>
916
+ <example>Sendmail ESMTP ready</example>
917
+ <param pos="0" name="service.family" value="Sendmail"/>
918
+ <param pos="0" name="service.product" value="Sendmail"/>
919
+ </fingerprint>
1066
920
  <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +([^ ]+) \(PHNE_([^ ]+)\) */ *(.+); *(.+) \(.+\)$">
1067
- <description>
1068
- sendmail on HPUX with a PHNE (HP Networking patch) installed
1069
- </description>
1070
- <example>foo.bar.com ESMTP Sendmail 8.8.6 (PHNE_14041)/8.7.1; Tue, 6 Feb 2001 10:04:32 -0300 (SAT)</example>
921
+ <description>Sendmail - HP-UX with a PHNE (HP Networking patch) installed</description>
922
+ <example host.name="foo.bar" service.version="8.8.6" sendmail.config.version="8.7.1">foo.bar ESMTP Sendmail 8.8.6 (PHNE_14041)/8.7.1; Tue, 6 Feb 2001 10:04:32 -0300 (SAT)</example>
1071
923
  <param pos="0" name="service.family" value="Sendmail"/>
1072
924
  <param pos="0" name="service.product" value="Sendmail"/>
1073
925
  <param pos="0" name="os.vendor" value="HP"/>
1074
926
  <param pos="0" name="os.family" value="HP-UX"/>
1075
927
  <param pos="0" name="os.device" value="General"/>
1076
928
  <param pos="0" name="os.product" value="HP-UX"/>
1077
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
929
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1078
930
  <param pos="1" name="host.name"/>
1079
931
  <param pos="2" name="service.version"/>
1080
932
  <param pos="3" name="sendmail.hpux.phne.version"/>
1081
933
  <param pos="4" name="sendmail.config.version"/>
1082
934
  <param pos="5" name="system.time"/>
1083
935
  </fingerprint>
1084
- <fingerprint pattern="^(\S+) ESMTP Sendmail \S+ version ([\d\.]+) - Revision \S+ HP-UX([\d\.]+).*(\S{3}, \d{2} \S{3} \d{4} \d{2}:\d{2}:\d{2} \S{3})$">
1085
- <description>
1086
- sendmail on HPUX
1087
- </description>
1088
- <example host.name="example.com" os.version="11.31" service.version="8.13.3">example.com ESMTP Sendmail @(#)Sendmail version 8.13.3 - Revision 1.004:: HP-UX11.31 - 03rd February,2010/8.11.1; Wed, 20 May 2015 23:35:38 GMT</example>
936
+ <fingerprint pattern="^(\S+) ESMTP Sendmail \S+ version ([\d\.]+) - Revision \S+ HP-UX([\d\.]+).*(\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ \w\w\w)$">
937
+ <description>Sendmail - HP-UX</description>
938
+ <example host.name="foo.bar" os.version="11.31" service.version="8.13.3">foo.bar ESMTP Sendmail @(#)Sendmail version 8.13.3 - Revision 1.004:: HP-UX11.31 - 03rd February,2010/8.11.1; Wed, 20 May 2015 23:35:38 GMT</example>
1089
939
  <param pos="0" name="service.family" value="Sendmail"/>
1090
940
  <param pos="0" name="service.product" value="Sendmail"/>
1091
941
  <param pos="0" name="os.vendor" value="HP"/>
@@ -1093,57 +943,51 @@ The system or service fingerprint with the highest certainty overwrites the othe
1093
943
  <param pos="0" name="os.device" value="General"/>
1094
944
  <param pos="0" name="os.product" value="HP-UX"/>
1095
945
  <param pos="3" name="os.version"/>
1096
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
946
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss z"/>
1097
947
  <param pos="1" name="host.name"/>
1098
948
  <param pos="2" name="service.version"/>
1099
949
  <param pos="4" name="system.time"/>
1100
950
  </fingerprint>
1101
951
  <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +([^ ]+)/UW([^ ]+) ready at *(.+) \(.+\) *$">
1102
- <description>
1103
- sendmail on unixware
1104
- </description>
1105
- <example>foo.bar.com ESMTP Sendmail 8.8.7/UW7.1.0 ready at Tue, 6 Feb 2001 16:39:30 -0300 (GMT-0300)</example>
952
+ <description>Sendmail - Unixware</description>
953
+ <example service.version="8.8.7">foo.bar ESMTP Sendmail 8.8.7/UW7.1.0 ready at Tue, 6 Feb 2001 16:39:30 -0300 (GMT-0300)</example>
1106
954
  <param pos="0" name="service.family" value="Sendmail"/>
1107
955
  <param pos="0" name="service.product" value="Sendmail"/>
1108
956
  <param pos="0" name="os.vendor" value="SCO"/>
1109
957
  <param pos="0" name="os.family" value="UnixWare"/>
1110
958
  <param pos="0" name="os.device" value="General"/>
1111
959
  <param pos="0" name="os.product" value="UnixWare"/>
1112
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
960
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1113
961
  <param pos="1" name="host.name"/>
1114
962
  <param pos="2" name="service.version"/>
1115
963
  <param pos="3" name="os.version"/>
1116
964
  <param pos="4" name="system.time"/>
1117
965
  </fingerprint>
1118
966
  <fingerprint pattern="^([^ ]+) ESMTP Sendmail AIX([^/]+)/UCB ([^;]+); (.+) \(.+\)$">
1119
- <description>
1120
- sendmail on AIX
1121
- </description>
1122
- <example>foo.bar.com ESMTP Sendmail AIX4.2/UCB 8.7; Sun, 29 Jul 2001 22:34:37 -0400 (EDT)</example>
967
+ <description>Sendmail - AIX (UCB variant)</description>
968
+ <example os.version="4.2" service.version="8.7">foo.bar ESMTP Sendmail AIX4.2/UCB 8.7; Sun, 29 Jul 2001 22:34:37 -0400 (EDT)</example>
1123
969
  <param pos="0" name="service.family" value="Sendmail"/>
1124
970
  <param pos="0" name="service.product" value="Sendmail"/>
1125
971
  <param pos="0" name="os.vendor" value="IBM"/>
1126
972
  <param pos="0" name="os.family" value="AIX"/>
1127
973
  <param pos="0" name="os.device" value="General"/>
1128
974
  <param pos="0" name="os.product" value="AIX"/>
1129
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
975
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1130
976
  <param pos="1" name="host.name"/>
1131
977
  <param pos="2" name="os.version"/>
1132
978
  <param pos="3" name="service.version"/>
1133
979
  <param pos="4" name="system.time"/>
1134
980
  </fingerprint>
1135
981
  <fingerprint pattern="^([^ ]+) Sendmail AIX([^/]+)/UCB ([^/]+)/([^ ]+) ready at (.+)$">
1136
- <description>
1137
- sendmail on AIX
1138
- </description>
1139
- <example>foo.bar.com Sendmail AIX 4.1/UCB 5.64/4.03 ready at Mon, 30 Jul 2001 00:42:21 -0500</example>
982
+ <description>Sendmail - AIX (UCB/ready at variant)</description>
983
+ <example>foo.bar Sendmail AIX 4.1/UCB 5.64/4.03 ready at Mon, 30 Jul 2001 00:42:21 -0500</example>
1140
984
  <param pos="0" name="service.family" value="Sendmail"/>
1141
985
  <param pos="0" name="service.product" value="Sendmail"/>
1142
986
  <param pos="0" name="os.vendor" value="IBM"/>
1143
987
  <param pos="0" name="os.family" value="AIX"/>
1144
988
  <param pos="0" name="os.device" value="General"/>
1145
989
  <param pos="0" name="os.product" value="AIX"/>
1146
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
990
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1147
991
  <param pos="1" name="host.name"/>
1148
992
  <param pos="2" name="os.version"/>
1149
993
  <param pos="3" name="service.version"/>
@@ -1151,18 +995,16 @@ The system or service fingerprint with the highest certainty overwrites the othe
1151
995
  <param pos="5" name="system.time"/>
1152
996
  </fingerprint>
1153
997
  <fingerprint pattern="^([^ ]+) ESMTP Sendmail AIX([^/]+)/([^/]+)/([^;]+); (.+)(?: \(.+\))?$">
1154
- <description>
1155
- sendmail on AIX
1156
- </description>
1157
- <example host.name="example.com" os.version="4.2" service.version="8.7" sendmail.config.version="8.8">example.com ESMTP Sendmail AIX4.2/8.7/8.8; Sun, 29 Jul 2001 22:34:37 -0400 (EDT)</example>
1158
- <example host.name="example.com" os.version="5.1" service.version="8.11.6p2" sendmail.config.version="8.11.0">example.com ESMTP Sendmail AIX5.1/8.11.6p2/8.11.0; Fri, 28 Aug 1970 19:42:05 -0800</example>
998
+ <description>Sendmail - AIX</description>
999
+ <example host.name="foo.bar" os.version="4.2" service.version="8.7" sendmail.config.version="8.8">foo.bar ESMTP Sendmail AIX4.2/8.7/8.8; Sun, 29 Jul 2001 22:34:37 -0400 (EDT)</example>
1000
+ <example host.name="foo.bar" os.version="5.1" service.version="8.11.6p2" sendmail.config.version="8.11.0">foo.bar ESMTP Sendmail AIX5.1/8.11.6p2/8.11.0; Fri, 28 Aug 1970 19:42:05 -0800</example>
1159
1001
  <param pos="0" name="service.family" value="Sendmail"/>
1160
1002
  <param pos="0" name="service.product" value="Sendmail"/>
1161
1003
  <param pos="0" name="os.vendor" value="IBM"/>
1162
1004
  <param pos="0" name="os.family" value="AIX"/>
1163
1005
  <param pos="0" name="os.device" value="General"/>
1164
1006
  <param pos="0" name="os.product" value="AIX"/>
1165
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1007
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1166
1008
  <param pos="1" name="host.name"/>
1167
1009
  <param pos="2" name="os.version"/>
1168
1010
  <param pos="3" name="service.version"/>
@@ -1170,17 +1012,15 @@ The system or service fingerprint with the highest certainty overwrites the othe
1170
1012
  <param pos="5" name="system.time"/>
1171
1013
  </fingerprint>
1172
1014
  <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/SuSE Linux ([^;]+); (.+)$">
1173
- <description>
1174
- sendmail on suse
1175
- </description>
1176
- <example>foo.bar.com ESMTP Sendmail 8.9.3/8.9.3/SuSE Linux 8.9.3-0.1; Mon, 30 Jul 2001 04:48:54 +0200</example>
1015
+ <description>Sendmail - SuSE Linux</description>
1016
+ <example>foo.bar ESMTP Sendmail 8.9.3/8.9.3/SuSE Linux 8.9.3-0.1; Mon, 30 Jul 2001 04:48:54 +0200</example>
1177
1017
  <param pos="0" name="service.family" value="Sendmail"/>
1178
1018
  <param pos="0" name="service.product" value="Sendmail"/>
1179
1019
  <param pos="0" name="os.vendor" value="SuSE"/>
1180
1020
  <param pos="0" name="os.family" value="Linux"/>
1181
1021
  <param pos="0" name="os.device" value="General"/>
1182
1022
  <param pos="0" name="os.product" value="Linux"/>
1183
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1023
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1184
1024
  <param pos="1" name="host.name"/>
1185
1025
  <param pos="2" name="service.version"/>
1186
1026
  <param pos="3" name="sendmail.config.version"/>
@@ -1188,129 +1028,190 @@ The system or service fingerprint with the highest certainty overwrites the othe
1188
1028
  <param pos="5" name="system.time"/>
1189
1029
  </fingerprint>
1190
1030
  <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^ ]+)\+Sun/([^ ]+); (.+)$">
1191
- <description>
1192
- sendmail on Solaris
1193
- </description>
1194
- <example>foo.bar.com ESMTP Sendmail 8.9.3+Sun/8.9.1; Mon, 30 Jul 2001 02:50:22 GMT</example>
1031
+ <description>Sendmail - Solaris with date (no time offeset variant)</description>
1032
+ <example>foo.bar ESMTP Sendmail 8.9.3+Sun/8.9.1; Mon, 30 Jul 2001 02:50:22 GMT</example>
1195
1033
  <param pos="0" name="service.family" value="Sendmail"/>
1196
1034
  <param pos="0" name="service.product" value="Sendmail"/>
1197
1035
  <param pos="0" name="os.vendor" value="Sun"/>
1198
1036
  <param pos="0" name="os.family" value="Solaris"/>
1199
1037
  <param pos="0" name="os.device" value="General"/>
1200
1038
  <param pos="0" name="os.product" value="Solaris"/>
1201
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1039
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss zzz"/>
1202
1040
  <param pos="1" name="host.name"/>
1203
1041
  <param pos="2" name="service.version"/>
1204
1042
  <param pos="3" name="sendmail.config.version"/>
1205
1043
  <param pos="4" name="system.time"/>
1206
1044
  </fingerprint>
1207
1045
  <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^ ]+)\+Sun/([^ ]+) ready at (.+) \(.+\)$">
1208
- <description>
1209
- sendmail on Solaris
1210
- </description>
1211
- <example>foo.bar.com ESMTP Sendmail 8.8.8+Sun/8.6.4 ready at Thu, 15 Nov 2000 11:40:32 -0800 (PST)</example>
1046
+ <description>Sendmail - Solaris with date (ready variant)</description>
1047
+ <example>foo.bar ESMTP Sendmail 8.8.8+Sun/8.6.4 ready at Thu, 15 Nov 2000 11:40:32 -0800 (PST)</example>
1212
1048
  <param pos="0" name="service.family" value="Sendmail"/>
1213
1049
  <param pos="0" name="service.product" value="Sendmail"/>
1214
1050
  <param pos="0" name="os.vendor" value="Sun"/>
1215
1051
  <param pos="0" name="os.family" value="Solaris"/>
1216
1052
  <param pos="0" name="os.device" value="General"/>
1217
1053
  <param pos="0" name="os.product" value="Solaris"/>
1218
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1054
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1219
1055
  <param pos="1" name="host.name"/>
1220
1056
  <param pos="2" name="service.version"/>
1221
1057
  <param pos="3" name="sendmail.config.version"/>
1222
1058
  <param pos="4" name="system.time"/>
1223
1059
  </fingerprint>
1224
- <fingerprint pattern="^([^ ]+) ESMTP Debian Sendmail ([^/]+)/([^/]+)/Debian ([^/]+); (.+) *$">
1225
- <description>
1226
- sendmail on debian
1227
- </description>
1228
- <example>foo.bar.com ESMTP Debian Sendmail 8.12.0.Beta7/8.12.0.Beta7/Debian 8.12.0.Beta7-1; Sun, 29 Jul 2001 18:52:20 -0800</example>
1060
+ <fingerprint pattern="^([^ ]+) ESMTP (?:Debian )?Sendmail ([^/]+)/([^/]+)/Debian ([^/]+); (.+) *$">
1061
+ <description>Sendmail - Debian</description>
1062
+ <example service.version="8.12.0.Beta7" sendmail.config.version="8.12.0.Beta7" sendmail.vendor.version="8.12.0.Beta7-1">foo.bar ESMTP Debian Sendmail 8.12.0.Beta7/8.12.0.Beta7/Debian 8.12.0.Beta7-1; Sun, 29 Jul 2001 18:52:20 -0800</example>
1063
+ <example service.version="8.11.0" sendmail.config.version="8.9.3" sendmail.vendor.version="8.9.3-21">foo.bar ESMTP Sendmail 8.11.0/8.9.3/Debian 8.9.3-21; Sun, 29 Jul 2001 19:51:00 -0700</example>
1229
1064
  <param pos="0" name="service.family" value="Sendmail"/>
1230
1065
  <param pos="0" name="service.product" value="Sendmail"/>
1231
1066
  <param pos="0" name="os.vendor" value="Debian"/>
1232
1067
  <param pos="0" name="os.family" value="Linux"/>
1233
1068
  <param pos="0" name="os.device" value="General"/>
1234
1069
  <param pos="0" name="os.product" value="Linux"/>
1235
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1070
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1236
1071
  <param pos="1" name="host.name"/>
1237
1072
  <param pos="2" name="service.version"/>
1238
1073
  <param pos="3" name="sendmail.config.version"/>
1239
1074
  <param pos="4" name="sendmail.vendor.version"/>
1240
1075
  <param pos="5" name="system.time"/>
1241
1076
  </fingerprint>
1242
- <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian ([^/]+); (.+) *$">
1243
- <description>
1244
- sendmail on debian
1245
- </description>
1246
- <example>foo.bar.com ESMTP Sendmail 8.11.0/8.9.3/Debian 8.9.3-21; Sun, 29 Jul 2001 19:51:00 -0700</example>
1077
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d\+(?:wheezy|deb7u)\d; (.+); .*$">
1078
+ <description>Sendmail - Debian 7.x (wheezy)</description>
1079
+ <example service.version="8.14.4">foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-4+wheezy1; Thu, 30 Nov 2017 10:33:05 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1080
+ <example service.version="8.14.4">foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-4+deb7u1; Thu, 30 Nov 2017 11:00:33 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1247
1081
  <param pos="0" name="service.family" value="Sendmail"/>
1248
1082
  <param pos="0" name="service.product" value="Sendmail"/>
1249
1083
  <param pos="0" name="os.vendor" value="Debian"/>
1250
1084
  <param pos="0" name="os.family" value="Linux"/>
1251
- <param pos="0" name="os.device" value="General"/>
1252
1085
  <param pos="0" name="os.product" value="Linux"/>
1253
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1086
+ <param pos="0" name="os.version" value="7.0"/>
1087
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1254
1088
  <param pos="1" name="host.name"/>
1255
1089
  <param pos="2" name="service.version"/>
1256
1090
  <param pos="3" name="sendmail.config.version"/>
1257
- <param pos="4" name="sendmail.vendor.version"/>
1258
- <param pos="5" name="system.time"/>
1091
+ <param pos="4" name="system.time"/>
1259
1092
  </fingerprint>
1260
- <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/[^/]+/Debian-\dubuntu[^ ]*; (.+); .*$">
1261
- <description>
1262
- Sendmail for Ubuntu
1263
- </description>
1264
- <example>foo.bar.com ESMTP Sendmail 8.13.5.20060308/8.13.5/Debian-3ubuntu1.1; Fri, 24 Jul 2009 01:41:21 -0700; (No UCE/UBE) logging access from: xyz.example.com(OK)-xyz.example.com [10.0.0.1]</example>
1093
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d\+deb8u\d; (.+); .*$">
1094
+ <description>Sendmail - Debian 8.x (jessie)</description>
1095
+ <example service.version="8.14.4">foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-8+deb8u2; Thu, 30 Nov 2017 10:25:48 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1096
+ <param pos="0" name="service.family" value="Sendmail"/>
1097
+ <param pos="0" name="service.product" value="Sendmail"/>
1098
+ <param pos="0" name="os.vendor" value="Debian"/>
1099
+ <param pos="0" name="os.family" value="Linux"/>
1100
+ <param pos="0" name="os.product" value="Linux"/>
1101
+ <param pos="0" name="os.version" value="8.0"/>
1102
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1103
+ <param pos="1" name="host.name"/>
1104
+ <param pos="2" name="service.version"/>
1105
+ <param pos="3" name="sendmail.config.version"/>
1106
+ <param pos="4" name="system.time"/>
1107
+ </fingerprint>
1108
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d\+lenny\d; (.+); .*$">
1109
+ <description>Sendmail - Debian 5.x (lenny)</description>
1110
+ <example service.version="8.14.3">foo.bar ESMTP Sendmail 8.14.3/8.14.3/Debian-5+lenny1; Thu, 30 Nov 2017 12:29:40 +0300; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1111
+ <param pos="0" name="service.family" value="Sendmail"/>
1112
+ <param pos="0" name="service.product" value="Sendmail"/>
1113
+ <param pos="0" name="os.vendor" value="Debian"/>
1114
+ <param pos="0" name="os.family" value="Linux"/>
1115
+ <param pos="0" name="os.product" value="Linux"/>
1116
+ <param pos="0" name="os.version" value="5.0"/>
1117
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1118
+ <param pos="1" name="host.name"/>
1119
+ <param pos="2" name="service.version"/>
1120
+ <param pos="3" name="sendmail.config.version"/>
1121
+ <param pos="4" name="system.time"/>
1122
+ </fingerprint>
1123
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d\+etch\d; (.+); .*$">
1124
+ <description>Sendmail - Debian 4.x (etch)</description>
1125
+ <example service.version="8.13.8" sendmail.config.version="8.13.8">foo.bar ESMTP Sendmail 8.13.8/8.13.8/Debian-3+etch1; Thu, 30 Nov 2017 10:28:23 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1126
+ <param pos="0" name="service.family" value="Sendmail"/>
1127
+ <param pos="0" name="service.product" value="Sendmail"/>
1128
+ <param pos="0" name="os.vendor" value="Debian"/>
1129
+ <param pos="0" name="os.family" value="Linux"/>
1130
+ <param pos="0" name="os.product" value="Linux"/>
1131
+ <param pos="0" name="os.version" value="4.0"/>
1132
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1133
+ <param pos="1" name="host.name"/>
1134
+ <param pos="2" name="service.version"/>
1135
+ <param pos="3" name="sendmail.config.version"/>
1136
+ <param pos="4" name="system.time"/>
1137
+ </fingerprint>
1138
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\dsarge\d; (.+); .*$">
1139
+ <description>Sendmail - Debian 3.1 (sarge)</description>
1140
+ <example service.version="8.13.4">foo.bar ESMTP Sendmail 8.13.4/8.13.4/Debian-3sarge1; Thu, 30 Nov 2017 10:55:47 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1141
+ <param pos="0" name="service.family" value="Sendmail"/>
1142
+ <param pos="0" name="service.product" value="Sendmail"/>
1143
+ <param pos="0" name="os.vendor" value="Debian"/>
1144
+ <param pos="0" name="os.family" value="Linux"/>
1145
+ <param pos="0" name="os.product" value="Linux"/>
1146
+ <param pos="0" name="os.version" value="3.1"/>
1147
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1148
+ <param pos="1" name="host.name"/>
1149
+ <param pos="2" name="service.version"/>
1150
+ <param pos="3" name="sendmail.config.version"/>
1151
+ <param pos="4" name="system.time"/>
1152
+ </fingerprint>
1153
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/([^/]+)/Debian-\d(?:\.\d)?(?:build\d)?+; (.+); .*$">
1154
+ <description>Sendmail - Debian patch only</description>
1155
+ <example service.version="8.15.2">foo.bar ESMTP Sendmail 8.15.2/8.15.2/Debian-3; Thu, 30 Nov 2017 10:55:50 +0200; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1156
+ <example service.version="8.14.3">foo.bar ESMTP Sendmail 8.14.3/8.14.3/Debian-9.4; Thu, 30 Nov 2017 10:11:54 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1157
+ <example service.version="8.14.2">foo.bar ESMTP Sendmail 8.14.2/8.14.2/Debian-2build1; Thu, 30 Nov 2017 04:09:50 -0600; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1158
+ <param pos="0" name="service.family" value="Sendmail"/>
1159
+ <param pos="0" name="service.product" value="Sendmail"/>
1160
+ <param pos="0" name="os.vendor" value="Debian"/>
1161
+ <param pos="0" name="os.family" value="Linux"/>
1162
+ <param pos="0" name="os.product" value="Linux"/>
1163
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1164
+ <param pos="1" name="host.name"/>
1165
+ <param pos="2" name="service.version"/>
1166
+ <param pos="3" name="sendmail.config.version"/>
1167
+ <param pos="4" name="system.time"/>
1168
+ </fingerprint>
1169
+ <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^/]+)/[^/]+/Debian-[\d.]+ubuntu[^ ]*; (.+); .*$">
1170
+ <description>Sendmail - Ubuntu</description>
1171
+ <example service.version="8.13.5.20060308">foo.bar ESMTP Sendmail 8.13.5.20060308/8.13.5/Debian-3ubuntu1.1; Fri, 24 Jul 2009 01:41:21 -0700; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1172
+ <example service.version="8.14.4">foo.bar ESMTP Sendmail 8.14.4/8.14.4/Debian-4.1ubuntu1; Thu, 30 Nov 2017 11:00:30 +0100; (No UCE/UBE) logging access from: xyz.foo.bar(OK)-xyz.foo.bar [10.0.0.1]</example>
1265
1173
  <param pos="0" name="service.family" value="Sendmail"/>
1266
1174
  <param pos="0" name="service.product" value="Sendmail"/>
1267
1175
  <param pos="0" name="os.vendor" value="Ubuntu"/>
1268
1176
  <param pos="0" name="os.family" value="Linux"/>
1269
- <param pos="0" name="os.device" value="General"/>
1270
1177
  <param pos="0" name="os.product" value="Linux"/>
1271
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1178
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1272
1179
  <param pos="1" name="host.name"/>
1273
1180
  <param pos="2" name="service.version"/>
1274
1181
  <param pos="3" name="system.time"/>
1275
1182
  </fingerprint>
1276
1183
  <fingerprint pattern="^([^ ]+) (?:E?SMTP )?Sendmail SMI-([^/]+)/(SMI-SVR4) ready at (.+)$">
1277
- <description>
1278
- unknown
1279
- </description>
1280
- <example>foo.bar.com Sendmail SMI-8.6/SMI-SVR4 ready at Sun, 29 Jul 2001 22:58:46 -0400</example>
1184
+ <description>Sendmail - Solaris (SMI variant)</description>
1185
+ <example>foo.bar Sendmail SMI-8.6/SMI-SVR4 ready at Sun, 29 Jul 2001 22:58:46 -0400</example>
1281
1186
  <param pos="0" name="service.family" value="Sendmail"/>
1282
1187
  <param pos="0" name="service.product" value="Sendmail"/>
1283
1188
  <param pos="0" name="os.vendor" value="Sun"/>
1284
1189
  <param pos="0" name="os.family" value="SunOS"/>
1285
1190
  <param pos="0" name="os.device" value="General"/>
1286
1191
  <param pos="0" name="os.product" value="Solaris"/>
1287
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1192
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1288
1193
  <param pos="1" name="host.name"/>
1289
1194
  <param pos="2" name="service.version"/>
1290
1195
  <param pos="3" name="sendmail.config.version"/>
1291
1196
  <param pos="4" name="system.time"/>
1292
1197
  </fingerprint>
1293
1198
  <fingerprint pattern="^([^ ]+) ESMTP Sendmail ([^ ]+)/(linuxconf); (.+)$">
1294
- <description>
1295
- unknown
1296
- </description>
1297
- <example>foo.bar.com ESMTP Sendmail 8.9.3/linuxconf; Sun, 29 Jul 2001 22:48:28 -0400</example>
1199
+ <description>Sendmail - unknown platform (linuxconf variant)</description>
1200
+ <example>foo.bar ESMTP Sendmail 8.9.3/linuxconf; Sun, 29 Jul 2001 22:48:28 -0400</example>
1298
1201
  <param pos="0" name="service.family" value="Sendmail"/>
1299
1202
  <param pos="0" name="service.product" value="Sendmail"/>
1300
1203
  <param pos="0" name="os.family" value="Linux"/>
1301
1204
  <param pos="0" name="os.device" value="General"/>
1302
1205
  <param pos="0" name="os.product" value="Linux"/>
1303
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1206
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1304
1207
  <param pos="1" name="host.name"/>
1305
1208
  <param pos="2" name="service.version"/>
1306
1209
  <param pos="3" name="sendmail.config.version"/>
1307
1210
  <param pos="4" name="system.time"/>
1308
1211
  </fingerprint>
1309
1212
  <fingerprint pattern="^([^ ]+) ESMTP MetaInfo Sendmail ([^ ]+) Build ([^ ]+) \(Berkeley ([^ ]+)\)/([^;]+); (.+)$">
1310
- <description>
1311
- unknown
1312
- </description>
1313
- <example>foo.bar.com ESMTP MetaInfo Sendmail 2.5 Build 2630 (Berkeley 8.8.6)/8.8.4; Mon, 30 Jul</example>
1213
+ <description>Sendmail - MetaInfo</description>
1214
+ <example>foo.bar ESMTP MetaInfo Sendmail 2.5 Build 2630 (Berkeley 8.8.6)/8.8.4; Mon, 30 Jul</example>
1314
1215
  <param pos="0" name="service.vendor" value="MetaInfo"/>
1315
1216
  <param pos="0" name="service.family" value="Sendmail"/>
1316
1217
  <param pos="0" name="service.product" value="Sendmail"/>
@@ -1318,7 +1219,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1318
1219
  <param pos="0" name="os.family" value="Windows"/>
1319
1220
  <param pos="0" name="os.device" value="General"/>
1320
1221
  <param pos="0" name="os.product" value="Windows NT"/>
1321
- <param pos="0" name="system.time.format" value="EEE, dd MMM"/>
1222
+ <param pos="0" name="system.time.format" value="EEE, d MMM"/>
1322
1223
  <param pos="1" name="host.name"/>
1323
1224
  <param pos="2" name="metainfo.version"/>
1324
1225
  <param pos="3" name="metainfo.version.version"/>
@@ -1326,186 +1227,120 @@ The system or service fingerprint with the highest certainty overwrites the othe
1326
1227
  <param pos="5" name="sendmail.config.version"/>
1327
1228
  <param pos="6" name="system.time"/>
1328
1229
  </fingerprint>
1329
- <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +([^ ]+\+[^ ]+) */ *([^ ]+\+[^ ]+); *(.+) \(.+\)$">
1330
- <description>
1331
- sendmail where both daemon and config file are patched
1332
- </description>
1333
- <example>foo.bar.com ESMTP Sendmail 8.9.3+3.4W/8.9.3+3.4W; Tue, 30 Jan 2001 20:40:09 -0500 (EST)</example>
1334
- <param pos="0" name="service.family" value="Sendmail"/>
1230
+ <fingerprint pattern="^([^ ]+) +ESMTP .*Sendmail +([^/ ]+) */ *([^/ ]+); *((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?)(?: \(.+\))?$">
1231
+ <description>Sendmail - optional timezone and timestamp, w/o OS</description>
1232
+ <example host.name="foo.bar" service.version="8.9.3+3.4W" sendmail.config.version="8.9.3+3.4W" system.time="Tue, 30 Jan 2001 20:40:09 -0500">foo.bar ESMTP Sendmail 8.9.3+3.4W/8.9.3+3.4W; Tue, 30 Jan 2001 20:40:09 -0500 (EST)</example>
1233
+ <example host.name="foo.bar" service.version="8.12.10" sendmail.config.version="8.12.10">foo.bar ESMTP Sendmail 8.12.10/8.12.10;</example>
1234
+ <example host.name="foo.bar" service.version="8.8.8" sendmail.config.version="8.8.9">foo.bar ESMTP Sendmail 8.8.8/8.8.9; Wed, 21 Nov 2001 23:39:07 +0100 (CET)</example>
1235
+ <example host.name="foo.bar" service.version="8.8.8" sendmail.config.version="8.8.9">foo.bar ESMTP blah Sendmail 8.8.8/8.8.9; Wed, 21 Nov 2001 23:39:07 +0100 (CET)</example>
1236
+ <example host.name="foo.bar" service.version="8.10.2" sendmail.config.version="8.10.3">foo.bar ESMTP Sendmail 8.10.2/8.10.3; Mon, 10 Sep 2001 08:37:14 -0400</example>
1237
+ <example host.name="foo.bar" service.version="8.13.8" sendmail.config.version="8.13.9">foo.bar ESMTP foo-MTA Sendmail 8.13.8/8.13.9; Mon, 18 Apr 2011 08:52:38 -0700</example>
1335
1238
  <param pos="0" name="service.product" value="Sendmail"/>
1336
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1239
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1337
1240
  <param pos="1" name="host.name"/>
1338
1241
  <param pos="2" name="service.version"/>
1339
1242
  <param pos="3" name="sendmail.config.version"/>
1340
1243
  <param pos="4" name="system.time"/>
1341
1244
  </fingerprint>
1342
- <fingerprint pattern="^([^ ]+) +ESMTP .*Sendmail +([^/ ]+) */ *([^/ ]+); *(.+)(?: \(.+\))?$">
1343
- <description>
1344
- sendmail where neither daemon nor config file are patched, with and without timezone
1345
- </description>
1346
- <example host.name="example.com" service.version="8.8.8" sendmail.config.version="8.8.9">example.com ESMTP Sendmail 8.8.8/8.8.9; Wed, 21 Nov 2001 23:39:07 +0100 (CET)</example>
1347
- <example host.name="example.com" service.version="8.8.8" sendmail.config.version="8.8.9">example.com ESMTP blah Sendmail 8.8.8/8.8.9; Wed, 21 Nov 2001 23:39:07 +0100 (CET)</example>
1348
- <example host.name="example.com" service.version="8.10.2" sendmail.config.version="8.10.3">example.com ESMTP Sendmail 8.10.2/8.10.3; Mon, 10 Sep 2001 08:37:14 -0400</example>
1349
- <example host.name="example.com" service.version="8.13.8" sendmail.config.version="8.13.9">example.com ESMTP foo-MTA Sendmail 8.13.8/8.13.9; Mon, 18 Apr 2011 08:52:38 -0700</example>
1350
- <param pos="0" name="service.family" value="Sendmail"/>
1245
+ <fingerprint pattern="^([^ ]+) +ESMTP .*Sendmail +([^/ ]+) */ *([^/ ]+); *(\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ \w+)\.?$">
1246
+ <description>Sendmail - with timezone and timestamp, w/o timezone offset or OS</description>
1247
+ <example host.name="foo.bar" service.version="8.14.4" sendmail.config.version="8.14.4" system.time="Thu, 5 Apr 2018 19:30:58 GMT">foo.bar ESMTP Sendmail 8.14.4/8.14.4; Thu, 5 Apr 2018 19:30:58 GMT</example>
1351
1248
  <param pos="0" name="service.product" value="Sendmail"/>
1352
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1249
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss z"/>
1353
1250
  <param pos="1" name="host.name"/>
1354
1251
  <param pos="2" name="service.version"/>
1355
1252
  <param pos="3" name="sendmail.config.version"/>
1356
1253
  <param pos="4" name="system.time"/>
1357
1254
  </fingerprint>
1358
- <fingerprint pattern="^([^ ]+) +Sendmail ready\. *$">
1359
- <description>
1360
- some old version of sendmail - TODO: figure out which versions this could be
1361
- </description>
1362
- <example>mail.foo.bar Sendmail ready.</example>
1255
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ([^ ]+) ready at *(\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)(?: \(.+\))$">
1256
+ <description>Sendmail - with version and date (optional timezone), w/o config version</description>
1257
+ <example host.name="foo.bar" service.version="8.8.8" system.time="Tue, 6 Feb 2001 14:37:14 +0100">foo.bar ESMTP Sendmail 8.8.8 ready at Tue, 6 Feb 2001 14:37:14 +0100 (CET)</example>
1363
1258
  <param pos="0" name="service.family" value="Sendmail"/>
1364
1259
  <param pos="0" name="service.product" value="Sendmail"/>
1365
- <param pos="1" name="host.name"/>
1366
- </fingerprint>
1367
- <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ([^ ]+) ready at *(.+) \(.+\)$">
1368
- <description>
1369
- sendmail with daemon version only
1370
- </description>
1371
- <example>mail.foo.bar ESMTP Sendmail 8.8.8 ready at Tue, 6 Feb 2001 14:37:14 +0100 (CET)</example>
1372
- <param pos="0" name="service.family" value="Sendmail"/>
1373
- <param pos="0" name="service.product" value="Sendmail"/>
1374
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1260
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1375
1261
  <param pos="1" name="host.name"/>
1376
1262
  <param pos="2" name="service.version"/>
1377
1263
  <param pos="3" name="system.time"/>
1378
1264
  </fingerprint>
1379
- <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ([^ /]+) \([^\)]+\) *(.+) \(.+\)$">
1380
- <description>
1381
- unknown
1382
- </description>
1383
- <example>mail.foo.bar ESMTP Sendmail 8.11.1 (1.1.2.11/12Jul01-1016AM) Wed, 8 Jan 2003 11:21:22 +0100 (MET)</example>
1265
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ([^ /]+) - \([^\)]+\)/[^ ]+;? *(\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)(?: \(.+\)) *$">
1266
+ <description>Sendmail - revision variant 1</description>
1267
+ <example>foo.foo.bar ESMTP Sendmail 8.11.1 - (Revision 1.010)/8.9.3; Sat, 22 Jan 2011 10:08:35 -0500 (EST)</example>
1384
1268
  <param pos="0" name="service.family" value="Sendmail"/>
1385
1269
  <param pos="0" name="service.product" value="Sendmail"/>
1386
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1270
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1387
1271
  <param pos="1" name="host.name"/>
1388
1272
  <param pos="2" name="service.version"/>
1389
1273
  <param pos="3" name="system.time"/>
1390
1274
  </fingerprint>
1391
- <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ([^ /]+) - \([^\)]+\)/[^ ]+;? *(.+) \(.+\)$">
1392
- <description>
1393
- unknown
1394
- </description>
1395
- <example>foo.example.com ESMTP Sendmail 8.11.1 - (Revision 1.010)/8.9.3; Sat, 22 Jan 2011 10:08:35 -0500 (EST)</example>
1275
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +(?:[^ ]+) +version +([^ ]+) +- +(?:[^;]+); *(\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)(?: \(.+\)) *$">
1276
+ <description>Sendmail - revision variant 2</description>
1277
+ <example>foo.foo.bar ESMTP Sendmail @(#)Sendmail version 8.13.3 - Revision 2.007 - 8 December 2008/8.8.6; Wed, 21 Jul 2010 11:17:01 -0400 (EDT)</example>
1396
1278
  <param pos="0" name="service.family" value="Sendmail"/>
1397
1279
  <param pos="0" name="service.product" value="Sendmail"/>
1398
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1280
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1399
1281
  <param pos="1" name="host.name"/>
1400
1282
  <param pos="2" name="service.version"/>
1401
1283
  <param pos="3" name="system.time"/>
1402
1284
  </fingerprint>
1403
- <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail +(?:[^ ]+) +version +([^ ]+) +- +(?:[^;]+); +(.+) +\(.+\)$">
1404
- <description>
1405
- unknown
1406
- </description>
1407
- <example>foo.example.com ESMTP Sendmail @(#)Sendmail version 8.13.3 - Revision 2.007 - 8 December 2008/8.8.6; Wed, 21 Jul 2010 11:17:01 -0400 (EDT)</example>
1285
+ <fingerprint pattern="^(?i)([^ ]+) +(?:ESMTP +)?Sendmail *(?: Ready.? ?)?(?:;|at)? ?((?:\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)?)(?: \(.+\))?$">
1286
+ <description>Sendmail - with date, w/o version or platform, optional status string.</description>
1287
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail ; Thu, 30 Nov 2017 17:50:14 +0900</example>
1288
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail; Thu, 30 Nov 2017 17:50:14 +0900</example>
1289
+ <example host.name="foo.bar" system.time="Wed, 20 May 2015 17:17:56 -0600">foo.bar ESMTP Sendmail Wed, 20 May 2015 17:17:56 -0600</example>
1290
+ <example host.name="foo.bar" system.time="Thu, 30 Nov 2017 10:24:14 +0100">foo.bar ESMTP Sendmail Ready; Thu, 30 Nov 2017 10:24:14 +0100</example>
1291
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail ready at Fri, 6 Apr 2018 04:57:01 +0900</example>
1292
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail ready</example>
1293
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail ready. </example>
1294
+ <example host.name="foo.bar">foo.bar ESMTP Sendmail</example>
1295
+ <example host.name="foo.bar">foo.bar Sendmail ready. </example>
1408
1296
  <param pos="0" name="service.family" value="Sendmail"/>
1409
- <param pos="0" name="service.product" value="Sendmail"/>
1410
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1411
- <param pos="1" name="host.name"/>
1412
- <param pos="2" name="service.version"/>
1413
- <param pos="3" name="system.time"/>
1414
- </fingerprint>
1415
- <fingerprint pattern="^Sendmail ESMTP ready$">
1416
- <description>
1417
- catch all for other versions of sendmail, no hostname or date
1418
- </description>
1419
- <example>Sendmail ESMTP ready</example>
1420
1297
  <param pos="0" name="service.family" value="Sendmail"/>
1421
1298
  <param pos="0" name="service.product" value="Sendmail"/>
1422
- </fingerprint>
1423
- <fingerprint pattern="^Sendmail ([^/]+)/([^/]+) ready on ([^ ]+)$">
1424
- <description>
1425
- catch all for other versions of sendmail
1426
- </description>
1427
- <param pos="0" name="service.family" value="Sendmail"/>
1428
- <param pos="0" name="service.product" value="Sendmail"/>
1429
- <param pos="1" name="service.version"/>
1430
- <param pos="2" name="sendmail.config.version"/>
1431
- <param pos="3" name="host.name"/>
1432
- </fingerprint>
1433
- <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ready at (.+) \(.+\)$">
1434
- <description>
1435
- catch all for other versions of sendmail
1436
- </description>
1437
- <param pos="0" name="service.family" value="Sendmail"/>
1438
- <param pos="0" name="service.product" value="Sendmail"/>
1439
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1440
1299
  <param pos="1" name="host.name"/>
1441
1300
  <param pos="2" name="system.time"/>
1301
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1442
1302
  </fingerprint>
1443
- <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ;.*$">
1444
- <description>
1445
- catch all for other versions of sendmail
1446
- </description>
1447
- <param pos="0" name="service.family" value="Sendmail"/>
1448
- <param pos="0" name="service.product" value="Sendmail"/>
1449
- <param pos="1" name="host.name"/>
1450
- </fingerprint>
1451
- <fingerprint pattern="^([^ ]+) ESMTP Sendmail ready$">
1452
- <description>
1453
- catch all for other versions of sendmail
1454
- </description>
1303
+ <fingerprint pattern="^ESMTP Sendmail +([^/ ]+) */ *([^/ ]+); (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d)$">
1304
+ <description>Sendmail - with version and date, w/o hostname or platform (semicolon variant)</description>
1305
+ <example service.version="8.13.1" sendmail.config.version="8.13.1" system.time="Thu, 30 Nov 2017 01:58:22 -0700">ESMTP Sendmail 8.13.1/8.13.1; Thu, 30 Nov 2017 01:58:22 -0700</example>
1455
1306
  <param pos="0" name="service.family" value="Sendmail"/>
1456
1307
  <param pos="0" name="service.product" value="Sendmail"/>
1457
- <param pos="1" name="host.name"/>
1308
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1309
+ <param pos="1" name="service.version"/>
1310
+ <param pos="2" name="sendmail.config.version"/>
1311
+ <param pos="3" name="system.time"/>
1458
1312
  </fingerprint>
1459
- <fingerprint pattern="^([^ ]+) Sendmail ([^/]+)/([^ ]+) ready at ([^;\.]+)$">
1460
- <description>
1461
- catch all for other versions of sendmail
1462
- </description>
1313
+ <fingerprint pattern="^([^ ]+) +ESMTP +Sendmail ([^ /]+) \([^\)]+\) *(.+) \(.+\)$">
1314
+ <description>Sendmail - unknown (date in version string variant)</description>
1315
+ <example>mail.foo.bar ESMTP Sendmail 8.11.1 (1.1.2.11/12Jul01-1016AM) Wed, 8 Jan 2003 11:21:22 +0100 (MET)</example>
1463
1316
  <param pos="0" name="service.family" value="Sendmail"/>
1464
1317
  <param pos="0" name="service.product" value="Sendmail"/>
1465
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1318
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1466
1319
  <param pos="1" name="host.name"/>
1467
1320
  <param pos="2" name="service.version"/>
1468
- <param pos="3" name="sendmail.config.version"/>
1469
- <param pos="4" name="system.time"/>
1321
+ <param pos="3" name="system.time"/>
1470
1322
  </fingerprint>
1323
+ <!-- *Sendmail* fingerprints after this line had NO matches in 2017.11.30 Project Sonar data set-->
1471
1324
  <fingerprint pattern="^([^ ]+) Sendmail ([^;]+); ([^;\.]+)$">
1472
- <description>
1473
- catch all for other versions of sendmail
1474
- </description>
1325
+ <description>Sendmail - unknown platform, variant 1</description>
1475
1326
  <param pos="0" name="service.family" value="Sendmail"/>
1476
1327
  <param pos="0" name="service.product" value="Sendmail"/>
1477
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1328
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss zzz"/>
1478
1329
  <param pos="1" name="host.name"/>
1479
1330
  <param pos="2" name="service.version"/>
1480
1331
  <param pos="3" name="system.time"/>
1481
1332
  </fingerprint>
1482
- <fingerprint pattern="^([^ ]+) ESMTP Sendmail$">
1483
- <description>
1484
- catch all for other versions of sendmail
1485
- </description>
1486
- <param pos="0" name="service.family" value="Sendmail"/>
1487
- <param pos="0" name="service.product" value="Sendmail"/>
1488
- <param pos="1" name="host.name"/>
1489
- </fingerprint>
1490
- <fingerprint pattern="^(\S+) ESMTP Sendmail (\S{3}, \d{1,2} \S{3} \d{4} \d{2}:\d{2}:\d{2} \S+)$">
1491
- <description>
1492
- catch all for other versions of sendmail, with a date/time
1493
- </description>
1494
- <example host.name="example.com">example.com ESMTP Sendmail Wed, 20 May 2015 17:17:56 -0600</example>
1495
- <example host.name="example.com">example.com ESMTP Sendmail Wed, 5 Aug 2015 17:40:38 -0400</example>
1333
+ <fingerprint pattern="^Sendmail ([^/]+)/([^/]+) ready on ([^ ]+)$">
1334
+ <description>Sendmail - basic with version and date</description>
1496
1335
  <param pos="0" name="service.family" value="Sendmail"/>
1497
1336
  <param pos="0" name="service.product" value="Sendmail"/>
1498
- <param pos="1" name="host.name"/>
1499
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1500
- <param pos="2" name="system.time"/>
1337
+ <param pos="1" name="service.version"/>
1338
+ <param pos="2" name="sendmail.config.version"/>
1339
+ <param pos="3" name="host.name"/>
1501
1340
  </fingerprint>
1502
- <!-- Sun Internet Mail Server -->
1503
- <!-- Sun Internet Mail Server sims\.([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+)([^\.]+) -->
1504
- <!-- these suckers can have LOTS of version numbers -->
1505
- <fingerprint pattern="^([^ ]+) -- Server ESMTP \(Sun Internet Mail Server sims\.([^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+)\)$">
1506
- <description>
1507
- 220 smtp.foo.bar -- Server ESMTP (Sun Internet Mail Server sims.4.0.2000.10.12.16.25.p8)
1508
- </description>
1341
+ <fingerprint pattern="^([^ ]+) -- Server ESMTP \(Sun Internet Mail Server sims\.(\d\.[\w.]+)\)$">
1342
+ <description>Sun Internet Mail Server</description>
1343
+ <example host.name="foo.bar" service.version="4.0.2000.10.12.16.25.p8">foo.bar -- Server ESMTP (Sun Internet Mail Server sims.4.0.2000.10.12.16.25.p8)</example>
1509
1344
  <param pos="0" name="service.vendor" value="Sun"/>
1510
1345
  <param pos="0" name="service.family" value="Internet Mail Server"/>
1511
1346
  <param pos="0" name="service.product" value="Internet Mail Server"/>
@@ -1516,27 +1351,23 @@ The system or service fingerprint with the highest certainty overwrites the othe
1516
1351
  <param pos="1" name="host.name"/>
1517
1352
  <param pos="2" name="service.version"/>
1518
1353
  </fingerprint>
1519
- <!-- these suckers can have LOTS of version numbers -->
1520
- <fingerprint pattern="^([^ ]+) -- Server ESMTP \(Sun Internet Mail Server sims\.([^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+)\)$">
1521
- <description>
1522
- 220 mercury.doc.ntu.ac.uk -- Server ESMTP (Sun Internet Mail Server sims.4.0.1999.06.13.00.20)
1523
- </description>
1524
- <param pos="0" name="service.vendor" value="Sun"/>
1525
- <param pos="0" name="service.family" value="Internet Mail Server"/>
1526
- <param pos="0" name="service.product" value="Internet Mail Server"/>
1527
- <param pos="0" name="os.vendor" value="Sun"/>
1528
- <param pos="0" name="os.family" value="Solaris"/>
1529
- <param pos="0" name="os.device" value="General"/>
1530
- <param pos="0" name="os.product" value="Solaris"/>
1354
+ <fingerprint pattern="^(?:2.0.0 )?([^ ]+) ESMTP ecelerity (\d\.[\d.]+) r\(([^)]+)\) (\w\w\w, \d+ \w\w\w \d\d\d\d [\d:]+ [-+]\d\d\d\d) *$">
1355
+ <description>Ecelerity</description>
1356
+ <example host.name="foo.bar" system.time="Thu, 30 Nov 2017 05:11:00 -0500">2.0.0 foo.bar ESMTP ecelerity 4.0.0.43760 r(Platform:4.0.0.1) Thu, 30 Nov 2017 05:11:00 -0500</example>
1357
+ <example>foo.bar ESMTP ecelerity 3.3.1.44388 r(44388) Thu, 30 Nov 2017 03:10:11 -0700</example>
1358
+ <example>foo.bar ESMTP ecelerity 3.6.25.56547 r(Core:3.6.25.0) Thu, 30 Nov 2017 03:17:07 -0600</example>
1359
+ <example service.version="4.2.37.61980" service.component.version=":">foo.bar ESMTP ecelerity 4.2.37.61980 r(:) Thu, 30 Nov 2017 09:58:54 +0000</example>
1360
+ <param pos="0" name="service.vendor" value="Ecelerity"/>
1361
+ <param pos="0" name="service.family" value="Ecelerity Mail Server"/>
1362
+ <param pos="0" name="service.product" value="Ecelerity Mail Server"/>
1363
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1531
1364
  <param pos="1" name="host.name"/>
1532
1365
  <param pos="2" name="service.version"/>
1366
+ <param pos="3" name="service.component.version"/>
1367
+ <param pos="4" name="system.time"/>
1533
1368
  </fingerprint>
1534
- <fingerprint pattern="^([^ ]+) SMTP Server SLMail v?(\d\.[\d.]+) Ready ESMTP spoken here *$" flags="REG_ICASE">
1535
- <description>
1536
- Seattle Labs SLMail server for Windows NT/2k (v2.7 runs on Win9x)
1537
- http://serverwatch.internet.com/reviews/mail-slmail.html
1538
- http://www.seattlelab.com/
1539
- </description>
1369
+ <fingerprint pattern="^(?i)([^ ]+) SMTP Server SLMail v?(\d\.[\d.]+) Ready ESMTP spoken here *$">
1370
+ <description>Seattle Labs SLMail server for Windows NT/2k (v2.7 runs on Win9x)</description>
1540
1371
  <example service.version="2.7">foo.bar Smtp Server SLMail v2.7 Ready ESMTP spoken here</example>
1541
1372
  <example service.version="3.2.3113">foo.bar SMTP Server SLmail 3.2.3113 Ready ESMTP spoken here</example>
1542
1373
  <example service.version="5.5.0.4433">foo.bar SMTP Server SLmail 5.5.0.4433 Ready ESMTP spoken here</example>
@@ -1560,10 +1391,29 @@ The system or service fingerprint with the highest certainty overwrites the othe
1560
1391
  <param pos="0" name="service.product" value="Symantec Messaging Gateway"/>
1561
1392
  <param pos="1" name="host.name"/>
1562
1393
  </fingerprint>
1394
+ <!-- SonicWall makes hardware, virtual appliances, and Windows software. The banner doesn't indicate which. -->
1395
+ <fingerprint pattern="^(?i)([^ ]+) ESMTP SonicWALL \(([\d.]+)\)$">
1396
+ <description>SonicWall Email Security</description>
1397
+ <example host.name="foo.bar" service.version="9.0.5.2077">foo.bar ESMTP SonicWALL (9.0.5.2077)</example>
1398
+ <example host.name="foo.bar" service.version="9.1.1.3113">foo.bar ESMTP SonicWall (9.1.1.3113)</example>
1399
+ <param pos="0" name="service.vendor" value="SonicWall"/>
1400
+ <param pos="0" name="service.vendor" value="SonicWall"/>
1401
+ <param pos="0" name="service.family" value="Email Security"/>
1402
+ <param pos="0" name="service.product" value="Email Security"/>
1403
+ <param pos="1" name="host.name"/>
1404
+ <param pos="2" name="service.version"/>
1405
+ </fingerprint>
1406
+ <fingerprint pattern="^([^ ]+) \(PowerMTA\(TM\) v([\d.r]+)\) ESMTP service ready$">
1407
+ <description>PowerMTA</description>
1408
+ <example host.name="foo.bar" service.version="3.2r24">foo.bar (PowerMTA(TM) v3.2r24) ESMTP service ready</example>
1409
+ <param pos="0" name="service.vendor" value="port25"/>
1410
+ <param pos="0" name="service.family" value="PowerMTA"/>
1411
+ <param pos="0" name="service.product" value="PowerMTA"/>
1412
+ <param pos="1" name="host.name"/>
1413
+ <param pos="2" name="service.version"/>
1414
+ </fingerprint>
1563
1415
  <fingerprint pattern="^([^ ]+) +VOPmail ESMTP Receiver Version (\d\.[\d.]+) Ready$">
1564
- <description>
1565
- VOPMail http://www.vircom.com/en/products/vopmail/vopmail.shtml
1566
- </description>
1416
+ <description>VOPMail http://www.vircom.com/en/products/vopmail/vopmail.shtml</description>
1567
1417
  <example host.name="foo.bar" service.version="4.0.179.0">foo.bar VOPmail ESMTP Receiver Version 4.0.179.0 Ready</example>
1568
1418
  <param pos="0" name="service.vendor" value="Vircom"/>
1569
1419
  <param pos="0" name="service.family" value="VOPMail"/>
@@ -1572,9 +1422,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1572
1422
  <param pos="2" name="service.version"/>
1573
1423
  </fingerprint>
1574
1424
  <fingerprint pattern="^([^ ]+) VPOP3 E?SMTP Server (?:Ready|access not allowed!)$">
1575
- <description>
1576
- VPOP3 Email server: http://www.pscs.co.uk/products/vpop3/index.html
1577
- </description>
1425
+ <description>VPOP3 Email server: http://www.pscs.co.uk/products/vpop3/index.html</description>
1578
1426
  <example>foo.bar VPOP3 ESMTP Server Ready</example>
1579
1427
  <example>foo.bar VPOP3 SMTP Server Ready</example>
1580
1428
  <example>foo.bar VPOP3 SMTP Server access not allowed!</example>
@@ -1583,44 +1431,26 @@ The system or service fingerprint with the highest certainty overwrites the othe
1583
1431
  <param pos="0" name="service.product" value="VPOP3"/>
1584
1432
  <param pos="1" name="host.name"/>
1585
1433
  </fingerprint>
1586
- <fingerprint pattern="^([^ ]+) WebShield SMTP V([^ ]+\.[^ ]+) Network Associates.*Ready at (.+) *$">
1587
- <description>
1588
- http://www.mcafeeb2b.com/products/webshield-smtp/default.asp
1589
- example:220 smtp.foo.bar WebShield SMTP V4.5 Network Associates, Inc. Ready at Fri Jun 22 02:36:23 2001
1590
- </description>
1591
- <param pos="0" name="service.vendor" value="McAfee"/>
1592
- <param pos="0" name="service.family" value="WebShield"/>
1593
- <param pos="0" name="service.product" value="WebShield"/>
1594
- <param pos="0" name="system.time.format" value="EEE dd MMM yyyy HH:mm:ss zzz"/>
1595
- <param pos="1" name="host.name"/>
1596
- <param pos="2" name="service.version"/>
1597
- <param pos="3" name="system.time"/>
1598
- </fingerprint>
1599
- <fingerprint pattern="^([^ ]+) WebShield SMTP V([^ ]+\.[^ ]+) ([^ ]+) Network Associates.*Ready at (.+) *$">
1600
- <description>
1601
- http://www.mcafeeb2b.com/products/webshield-smtp/default.asp
1602
- example:220 wsigate WebShield SMTP V4.5 MR1 Network Associates, Inc. Ready at Sun Jul 29 22:47:44 2001
1603
- </description>
1434
+ <fingerprint pattern="^([^ ]+) WebShield SMTP V([^ ]+\.[^ ]+) (:?[^ ]+)? ?Network Associates.*Ready at (.+) *$">
1435
+ <description>McAfee WebShield</description>
1436
+ <example host.name="foo.bar" service.version="4.5" service.version.version="MR1a">foo.bar WebShield SMTP V4.5 MR1a Network Associates, Inc. Ready at Thu Nov 30 09:15:32 2017</example>
1437
+ <example host.name="foo.bar" service.version="4.5" system.time="Thu Nov 30 09:15:32 2017">foo.bar WebShield SMTP V4.5 Network Associates, Inc. Ready at Thu Nov 30 09:15:32 2017</example>
1604
1438
  <param pos="0" name="service.vendor" value="McAfee"/>
1605
1439
  <param pos="0" name="service.family" value="WebShield"/>
1606
1440
  <param pos="0" name="service.product" value="WebShield"/>
1607
- <param pos="0" name="system.time.format" value="EEE dd MMM yyyy HH:mm:ss zzz"/>
1441
+ <param pos="0" name="system.time.format" value="EEE d MMM HH:mm:ss yyyy"/>
1608
1442
  <param pos="1" name="host.name"/>
1609
1443
  <param pos="2" name="service.version"/>
1610
1444
  <param pos="3" name="service.version.version"/>
1611
1445
  <param pos="4" name="system.time"/>
1612
1446
  </fingerprint>
1613
1447
  <fingerprint pattern="^([^ ]+) McAfee WebShield ASaP v([^ ]+\.[^ ]+\.[^ ]+): (.+) *$">
1614
- <description>
1615
- McAfee Webshield ASaP is a combination hardware/software platform,
1616
- basically consisting of a 1U Linux rackmount box with McAfee's filtering software
1617
- http://www.mcafeeb2b.com/services/webshield-asap/faq.asp
1618
- example: 220 smtp.foo.bar McAfee WebShield ASaP v1.0.1: Sun, 29 Jul 2001 22:46:18 -0700
1619
- </description>
1448
+ <description>McAfee Webshield ASaP (bundled hardware / software)</description>
1449
+ <example host.name="foo.bar" service.version="1.0.1" system.time="Sun, 29 Jul 2001 22:46:18 -0700">foo.bar McAfee WebShield ASaP v1.0.1: Sun, 29 Jul 2001 22:46:18 -0700</example>
1620
1450
  <param pos="0" name="service.vendor" value="McAfee"/>
1621
1451
  <param pos="0" name="service.family" value="WebShield"/>
1622
1452
  <param pos="0" name="service.product" value="WebShield"/>
1623
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1453
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1624
1454
  <param pos="0" name="os.vendor" value="McAfee"/>
1625
1455
  <param pos="0" name="os.family" value="Linux"/>
1626
1456
  <param pos="0" name="os.device" value="General"/>
@@ -1630,13 +1460,12 @@ The system or service fingerprint with the highest certainty overwrites the othe
1630
1460
  <param pos="3" name="system.time"/>
1631
1461
  </fingerprint>
1632
1462
  <fingerprint pattern="^([^ ]+) McAfee VirusScreen ASaP v([^ ]+\.[^ ]+): (.+) *$">
1633
- <description>
1634
- example: 220 smtp.foo.bar McAfee VirusScreen ASaP v1.1: Sun, 20 Jul 2003 09:20:52 -0700
1635
- </description>
1463
+ <description>McAfee VirusScreen</description>
1464
+ <example host.name="foo.bar" service.version="1.1" system.time="Sun, 20 Jul 2003 09:20:52 -0700">foo.bar McAfee VirusScreen ASaP v1.1: Sun, 20 Jul 2003 09:20:52 -0700</example>
1636
1465
  <param pos="0" name="service.vendor" value="McAfee"/>
1637
1466
  <param pos="0" name="service.family" value="WebShield"/>
1638
1467
  <param pos="0" name="service.product" value="WebShield"/>
1639
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1468
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1640
1469
  <param pos="0" name="os.vendor" value="McAfee"/>
1641
1470
  <param pos="0" name="os.family" value="Linux"/>
1642
1471
  <param pos="0" name="os.device" value="General"/>
@@ -1645,11 +1474,16 @@ The system or service fingerprint with the highest certainty overwrites the othe
1645
1474
  <param pos="2" name="service.version"/>
1646
1475
  <param pos="3" name="system.time"/>
1647
1476
  </fingerprint>
1477
+ <fingerprint pattern="^([^ ]+) ESMTP Lyris ListManager service ready$">
1478
+ <description>Lyris ListManager</description>
1479
+ <example host.name="foo.bar">foo.bar ESMTP Lyris ListManager service ready</example>
1480
+ <param pos="0" name="service.vendor" value="Lyris"/>
1481
+ <param pos="0" name="service.family" value="ListManager"/>
1482
+ <param pos="0" name="service.product" value="ListManager"/>
1483
+ <param pos="1" name="host.name"/>
1484
+ </fingerprint>
1648
1485
  <fingerprint pattern="^([^ ]+) ESMTP - WinRoute Pro ([^ ]+\.[^ ]+)$">
1649
- <description>
1650
- WinRoute Pro, runs on 9x/NT/2k
1651
- http://www.tinysoftware.com/winpro.php
1652
- </description>
1486
+ <description>WinRoute Pro, runs on 9x/NT/2k http://www.tinysoftware.com/winpro.php</description>
1653
1487
  <example host.name="foo.bar" service.version="4.2.4">foo.bar ESMTP - WinRoute Pro 4.2.4</example>
1654
1488
  <param pos="0" name="service.family" value="WinRoute"/>
1655
1489
  <param pos="0" name="service.product" value="WinRoute"/>
@@ -1661,7 +1495,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1661
1495
  <example service.version="4.2.1">ESMTP - WinRoute Pro 4.2.1 Thu, 16 Nov 2017 11:48:15 +0300</example>
1662
1496
  <param pos="0" name="service.family" value="WinRoute"/>
1663
1497
  <param pos="0" name="service.product" value="WinRoute"/>
1664
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1498
+ <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss Z"/>
1665
1499
  <param pos="1" name="service.version"/>
1666
1500
  <param pos="2" name="system.time"/>
1667
1501
  </fingerprint>
@@ -1671,7 +1505,7 @@ The system or service fingerprint with the highest certainty overwrites the othe
1671
1505
  <param pos="0" name="service.vendor" value="ZMailer"/>
1672
1506
  <param pos="0" name="service.family" value="ZMailer"/>
1673
1507
  <param pos="0" name="service.product" value="ZMailer"/>
1674
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1508
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1675
1509
  <param pos="1" name="host.name"/>
1676
1510
  <param pos="2" name="service.version"/>
1677
1511
  <param pos="3" name="service.version.version"/>
@@ -1683,27 +1517,84 @@ The system or service fingerprint with the highest certainty overwrites the othe
1683
1517
  <param pos="0" name="service.vendor" value="ZMailer"/>
1684
1518
  <param pos="0" name="service.family" value="ZMailer"/>
1685
1519
  <param pos="0" name="service.product" value="ZMailer"/>
1686
- <param pos="0" name="system.time.format" value="EEE, dd MMM yyyy HH:mm:ss zzz"/>
1520
+ <param pos="0" name="system.time.format" value="EEE, d MMM yyyy HH:mm:ss Z"/>
1687
1521
  <param pos="0" name="zmailer.ident" value="yes"/>
1688
1522
  <param pos="1" name="host.name"/>
1689
1523
  <param pos="2" name="service.version"/>
1690
1524
  <param pos="3" name="service.version.version"/>
1691
1525
  <param pos="4" name="system.time"/>
1692
1526
  </fingerprint>
1693
- <fingerprint pattern="^(\S+) E?SMTP Perl" flags="REG_ICASE">
1527
+ <fingerprint pattern="^([^ ]+) Kerio Connect (\d\.[\d.]+) (?:patch (\d) )?ESMTP ready$">
1528
+ <description>Kerio Connect ESMTP</description>
1529
+ <example host.name="foo.bar" service.version="8.0.2">foo.bar Kerio Connect 8.0.2 ESMTP ready</example>
1530
+ <example service.version="9.2.5" service.version.version="3">foo.bar Kerio Connect 9.2.5 patch 3 ESMTP ready</example>
1531
+ <param pos="0" name="service.vendor" value="Kerio"/>
1532
+ <param pos="0" name="service.family" value="Connect"/>
1533
+ <param pos="0" name="service.product" value="ESMTP"/>
1534
+ <param pos="1" name="host.name"/>
1535
+ <param pos="2" name="service.version"/>
1536
+ <param pos="3" name="service.version.version"/>
1537
+ </fingerprint>
1538
+ <fingerprint pattern="^([^ ]+) ESMTP CommuniGate Pro (\d\.[\w.]+)(?:. It is you again :-\()?$">
1539
+ <description>Communigate Pro</description>
1540
+ <example host.name="foo.bar" service.version="5.3.1">foo.bar ESMTP CommuniGate Pro 5.3.1</example>
1541
+ <example host.name="foo.bar" service.version="6.2c3">foo.bar ESMTP CommuniGate Pro 6.2c3</example>
1542
+ <example host.name="foo.bar" service.version="4.3.12">foo.bar ESMTP CommuniGate Pro 4.3.12. It is you again :-(</example>
1543
+ <param pos="0" name="service.vendor" value="Communigater"/>
1544
+ <param pos="0" name="service.family" value="Pro"/>
1545
+ <param pos="0" name="service.product" value="ESMTP"/>
1546
+ <param pos="1" name="host.name"/>
1547
+ <param pos="2" name="service.version"/>
1548
+ </fingerprint>
1549
+ <fingerprint pattern="^(\S+) NO UCE NO UBE NO RELAY PROBES ESMTP">
1550
+ <description>Twisted SMTP server</description>
1551
+ <example host.name="foo.bar">foo.bar NO UCE NO UBE NO RELAY PROBES ESMTP</example>
1552
+ <param pos="0" name="service.vendor" value="Twisted Matrix Labs"/>
1553
+ <param pos="0" name="service.family" value="Twisted"/>
1554
+ <param pos="0" name="service.product" value="ESMTP"/>
1555
+ <param pos="1" name="host.name"/>
1556
+ </fingerprint>
1557
+ <fingerprint pattern="^Cellopoint E-mail Firewall v(\d\.[\d.]+) Build (\d+) ready$">
1558
+ <description>Cellopoint E-mail Firewall</description>
1559
+ <example service.version="3.9.12" service.version.version="0324">Cellopoint E-mail Firewall v3.9.12 Build 0324 ready</example>
1560
+ <param pos="0" name="service.vendor" value="Cellopoint"/>
1561
+ <param pos="0" name="service.family" value="UTM"/>
1562
+ <param pos="0" name="service.product" value="E-mail Firewall"/>
1563
+ <param pos="1" name="service.version"/>
1564
+ <param pos="2" name="service.version.version"/>
1565
+ </fingerprint>
1566
+ <fingerprint pattern="^ESMTP on WinWebMail \[(\d\.[\d.]+)\] ready\. http://www.winwebmail.com$">
1567
+ <description>Ma Jian WinWebMail</description>
1568
+ <example service.version="3.9.0.7">ESMTP on WinWebMail [3.9.0.7] ready. http://www.winwebmail.com</example>
1569
+ <param pos="0" name="service.vendor" value="Ma Jian"/>
1570
+ <param pos="0" name="service.family" value="WinWebMail"/>
1571
+ <param pos="0" name="service.product" value="ESMTP"/>
1572
+ <param pos="1" name="service.version"/>
1573
+ </fingerprint>
1574
+ <fingerprint pattern="^([^ ]+) Service ready by David.fx \((\d+)\) ESMTP Server \(Tobit.Software, Germany\)$">
1575
+ <description>Tobit Software David</description>
1576
+ <example service.version="0486">foo.bar Service ready by David.fx (0486) ESMTP Server (Tobit.Software, Germany)</example>
1577
+ <param pos="0" name="service.vendor" value="Tobit Software"/>
1578
+ <param pos="0" name="service.family" value="David"/>
1579
+ <param pos="0" name="service.product" value="ESMTP"/>
1580
+ <param pos="1" name="host.name"/>
1581
+ <param pos="2" name="service.version"/>>
1582
+ </fingerprint>
1583
+ <fingerprint pattern="^(?i)(\S+) E?SMTP Perl">
1694
1584
  <description>Some simple PERL SMTP server</description>
1695
- <example host.name="example.com">example.com ESMTP Perl</example>
1585
+ <example host.name="foo.bar">foo.bar ESMTP Perl</example>
1696
1586
  <param pos="0" name="service.product" value="Perl"/>
1697
1587
  <param pos="1" name="host.name"/>
1698
1588
  </fingerprint>
1699
- <fingerprint pattern="^([^ ]+) E?SMTP(?: (?:Service )?Ready\.?)?$" flags="REG_ICASE">
1700
- <description>
1701
- catch all for daemons that have no distinguishing fingerprint whatsoever
1702
- </description>
1703
- <example host.name="example.com">example.com ESMTP</example>
1704
- <example host.name="example.com">example.com ESMTP Ready</example>
1705
- <example host.name="example.com">example.com SMTP</example>
1706
- <example host.name="example.com">example.com ESMTP Service ready</example>
1589
+ <fingerprint pattern="^(?i)(?:([^ ]+) )?E?SMTP(?: (?:Service )?Ready\.?)?$">
1590
+ <description>Non-specific banner with optional hostname</description>
1591
+ <example host.name="foo.bar">foo.bar ESMTP</example>
1592
+ <example host.name="foo.bar">foo.bar ESMTP Ready</example>
1593
+ <example host.name="foo.bar">foo.bar SMTP</example>
1594
+ <example host.name="foo.bar">foo.bar ESMTP Service ready</example>
1595
+ <example>ESMTP ready</example>
1596
+ <example>SMTP Ready</example>
1597
+ <example>ESMTP READY</example>
1707
1598
  <param pos="0" name="service.product" value="Unknown"/>
1708
1599
  <param pos="1" name="host.name"/>
1709
1600
  </fingerprint>