recog 2.3.22 → 2.3.23

data/xml/http_servers.xml

@@ -124,8 +124,8 @@
 
   <fingerprint pattern="^Stronghold/(\d\.\d) Apache/([012][\d.]*)\s*(.*)$">
     <description>Red Hat Stronghold Enterprise Apache</description>
-    <example service.version="1.3.19" service.cpe23="cpe:/a:apache:http_server:1.3.19" service.component.cpe23="cpe:/a:redhat:stronghold:3.0">Stronghold/3.0 Apache/1.3.19 RedHat/3014c</example>
-    <example service.version="1.3.22" service.cpe23="cpe:/a:apache:http_server:1.3.22" service.component.cpe23="cpe:/a:redhat:stronghold:4.0" apache.info="(Unix) mod_ssl/2.8.7 OpenSSL/0.9.6c mod_perl/1.26">Stronghold/4.0 Apache/1.3.22 (Unix) mod_ssl/2.8.7 OpenSSL/0.9.6c mod_perl/1.26</example>
+    <example service.version="1.3.19" service.cpe23="cpe:/a:apache:http_server:1.3.19" service.component.cpe23="cpe:/a:redhat:stronghold:3.0" service.component.version="3.0" apache.info="RedHat/3014c">Stronghold/3.0 Apache/1.3.19 RedHat/3014c</example>
+    <example service.version="1.3.22" service.cpe23="cpe:/a:apache:http_server:1.3.22" service.component.cpe23="cpe:/a:redhat:stronghold:4.0" apache.info="(Unix) mod_ssl/2.8.7 OpenSSL/0.9.6c mod_perl/1.26" service.component.version="4.0">Stronghold/4.0 Apache/1.3.22 (Unix) mod_ssl/2.8.7 OpenSSL/0.9.6c mod_perl/1.26</example>
     <param pos="0" name="service.vendor" value="Apache"/>
     <param pos="0" name="service.product" value="HTTPD"/>
     <param pos="0" name="service.family" value="Apache"/>
@@ -175,22 +175,22 @@
 
   <fingerprint pattern="(?i)^Apache(?:-AdvancedExtranetServer)?(?:/([012][\d.]*)\s*(.*))?$">
     <description>Apache</description>
-    <example>Apache-AdvancedExtranetServer/2.0.44 (Mandrake Linux/11mdk) mod_perl/1.99_08 Perl/v5.8.0 mod_ssl/2.0.44 OpenSSL/0.9.7a PHP/4.3.1 mod_jk2/2.0.0</example>
-    <example>Apache-AdvancedExtranetServer/2.0.47 (Mandrake Linux/6.12.92mdk) mod_perl/1.99_09 Perl/v5.8.1 mod_ssl/2.0.47 OpenSSL/0.9.7b PHP/4.3.2</example>
-    <example>Apache-AdvancedExtranetServer/2.0.47 (Mandrake Linux/6.3.92mdk) mod_ssl/2.0.47 OpenSSL/0.9.7b PHP/4.3.2</example>
-    <example>Apache-AdvancedExtranetServer/2.0.48 (Mandrake Linux/6.8.100mdk) mod_perl/1.99_11 Perl/v5.8.3 mod_ssl/2.0.48 OpenSSL/0.9.7c PHP/4.3.4</example>
-    <example>Apache-AdvancedExtranetServer/2.0.48 (Mandrake Linux/6mdk) PHP/4.3.4</example>
-    <example>Apache-AdvancedExtranetServer/2.0.53 (Mandrakelinux/PREFORK-9mdk) mod_ssl/2.0.53 OpenSSL/0.9.7e PHP/4.3.10 mod_perl/1.999.21 Perl/v5.8.6</example>
-    <example>Apache/0.6.5</example>
-    <example>Apache/1.1.3</example>
-    <example>Apache/1.2.42 (PalmOS)</example>
-    <example>Apache/1.3.28 (SolutionIP) mod_perl/1.28 mod_ssl/2.8.15 OpenSSL/0.9.7b</example>
-    <example>Apache/1.3.28 (Unix)</example>
-    <example>Apache/1.3.28 (Unix) mod_auth_pam/1.1.1</example>
-    <example>Apache/2.2.3 (Red Hat)</example>
-    <example>Apache/2.2.4 (Win32) PHP/5.2.2</example>
-    <example>Apache/2.2.4 (Win32) PHP/5.2.3</example>
-    <example>APACHE/1.3.9</example>
+    <example service.version="2.0.44" apache.info="(Mandrake Linux/11mdk) mod_perl/1.99_08 Perl/v5.8.0 mod_ssl/2.0.44 OpenSSL/0.9.7a PHP/4.3.1 mod_jk2/2.0.0">Apache-AdvancedExtranetServer/2.0.44 (Mandrake Linux/11mdk) mod_perl/1.99_08 Perl/v5.8.0 mod_ssl/2.0.44 OpenSSL/0.9.7a PHP/4.3.1 mod_jk2/2.0.0</example>
+    <example service.version="2.0.47" apache.info="(Mandrake Linux/6.12.92mdk) mod_perl/1.99_09 Perl/v5.8.1 mod_ssl/2.0.47 OpenSSL/0.9.7b PHP/4.3.2">Apache-AdvancedExtranetServer/2.0.47 (Mandrake Linux/6.12.92mdk) mod_perl/1.99_09 Perl/v5.8.1 mod_ssl/2.0.47 OpenSSL/0.9.7b PHP/4.3.2</example>
+    <example service.version="2.0.47" apache.info="(Mandrake Linux/6.3.92mdk) mod_ssl/2.0.47 OpenSSL/0.9.7b PHP/4.3.2">Apache-AdvancedExtranetServer/2.0.47 (Mandrake Linux/6.3.92mdk) mod_ssl/2.0.47 OpenSSL/0.9.7b PHP/4.3.2</example>
+    <example service.version="2.0.48" apache.info="(Mandrake Linux/6.8.100mdk) mod_perl/1.99_11 Perl/v5.8.3 mod_ssl/2.0.48 OpenSSL/0.9.7c PHP/4.3.4">Apache-AdvancedExtranetServer/2.0.48 (Mandrake Linux/6.8.100mdk) mod_perl/1.99_11 Perl/v5.8.3 mod_ssl/2.0.48 OpenSSL/0.9.7c PHP/4.3.4</example>
+    <example service.version="2.0.48" apache.info="(Mandrake Linux/6mdk) PHP/4.3.4">Apache-AdvancedExtranetServer/2.0.48 (Mandrake Linux/6mdk) PHP/4.3.4</example>
+    <example service.version="2.0.53" apache.info="(Mandrakelinux/PREFORK-9mdk) mod_ssl/2.0.53 OpenSSL/0.9.7e PHP/4.3.10 mod_perl/1.999.21 Perl/v5.8.6">Apache-AdvancedExtranetServer/2.0.53 (Mandrakelinux/PREFORK-9mdk) mod_ssl/2.0.53 OpenSSL/0.9.7e PHP/4.3.10 mod_perl/1.999.21 Perl/v5.8.6</example>
+    <example service.version="0.6.5">Apache/0.6.5</example>
+    <example service.version="1.1.3">Apache/1.1.3</example>
+    <example service.version="1.2.42" apache.info="(PalmOS)">Apache/1.2.42 (PalmOS)</example>
+    <example service.version="1.3.28" apache.info="(SolutionIP) mod_perl/1.28 mod_ssl/2.8.15 OpenSSL/0.9.7b">Apache/1.3.28 (SolutionIP) mod_perl/1.28 mod_ssl/2.8.15 OpenSSL/0.9.7b</example>
+    <example service.version="1.3.28" apache.info="(Unix)">Apache/1.3.28 (Unix)</example>
+    <example service.version="1.3.28" apache.info="(Unix) mod_auth_pam/1.1.1">Apache/1.3.28 (Unix) mod_auth_pam/1.1.1</example>
+    <example service.version="2.2.3" apache.info="(Red Hat)">Apache/2.2.3 (Red Hat)</example>
+    <example service.version="2.2.4" apache.info="(Win32) PHP/5.2.2">Apache/2.2.4 (Win32) PHP/5.2.2</example>
+    <example service.version="2.2.4" apache.info="(Win32) PHP/5.2.3">Apache/2.2.4 (Win32) PHP/5.2.3</example>
+    <example service.version="1.3.9">APACHE/1.3.9</example>
     <param pos="0" name="service.vendor" value="Apache"/>
     <param pos="0" name="service.product" value="HTTPD"/>
     <param pos="0" name="service.family" value="Apache"/>
@@ -252,7 +252,7 @@
 
   <fingerprint pattern="^Microsoft-IIS/([1234]\.0)$">
     <description>Microsoft IIS 1.0 - 4.0 runs on Windows NT 4.0</description>
-    <example>Microsoft-IIS/4.0</example>
+    <example service.version="4.0">Microsoft-IIS/4.0</example>
     <param pos="0" name="service.vendor" value="Microsoft"/>
     <param pos="0" name="service.product" value="IIS"/>
     <param pos="0" name="service.family" value="IIS"/>
@@ -378,7 +378,7 @@
 
   <fingerprint pattern="^Microsoft-IIS/([\d\.]+)$">
     <description>Microsoft IIS new, unknown Windows version</description>
-    <example>Microsoft-IIS/9.0</example>
+    <example service.version="9.0">Microsoft-IIS/9.0</example>
     <param pos="0" name="service.vendor" value="Microsoft"/>
     <param pos="0" name="service.product" value="IIS"/>
     <param pos="0" name="service.family" value="IIS"/>
@@ -399,7 +399,7 @@
 
   <fingerprint pattern="^MS .NET Remoting, MS .NET CLR (\d+\.\d+\.\d+\.\d+)$">
     <description>Microsoft .NET Remoting and Common Language Runtime (CLR)</description>
-    <example>MS .NET Remoting, MS .NET CLR 2.0.50727.42</example>
+    <example service.component.version="2.0.50727.42">MS .NET Remoting, MS .NET CLR 2.0.50727.42</example>
     <param pos="0" name="service.vendor" value="Microsoft"/>
     <param pos="0" name="service.product" value=".NET Remoting"/>
     <param pos="0" name="service.family" value=".NET"/>
@@ -415,9 +415,9 @@
 
   <fingerprint pattern="^Microsoft-WinCE/(\d\.\d+)$">
     <description>Windows CE embedded devices, including HP iPAQ, Palm Treo, Motorola phones, and many more</description>
-    <example os.version="4.10">Microsoft-WinCE/4.10</example>
-    <example>Microsoft-WinCE/4.20</example>
-    <example>Microsoft-WinCE/5.0</example>
+    <example os.version="4.10" service.version="4.10">Microsoft-WinCE/4.10</example>
+    <example service.version="4.20" os.version="4.20">Microsoft-WinCE/4.20</example>
+    <example service.version="5.0" os.version="5.0">Microsoft-WinCE/5.0</example>
     <param pos="0" name="service.vendor" value="Microsoft"/>
     <param pos="0" name="service.product" value="Windows CE Web Server"/>
     <param pos="0" name="service.family" value="Windows CE Web Server"/>
@@ -432,7 +432,7 @@
 
   <fingerprint pattern="^Microsoft-PWS/(\d\.\d+)$">
     <description>Microsoft Personal Web Server runs on Windows 9x, ME, etc.</description>
-    <example>Microsoft-PWS/4.0</example>
+    <example service.version="4.0">Microsoft-PWS/4.0</example>
     <param pos="0" name="service.vendor" value="Microsoft"/>
     <param pos="0" name="service.family" value="PWS"/>
     <param pos="0" name="service.product" value="PWS"/>
@@ -446,7 +446,7 @@
 
   <fingerprint pattern="^Microsoft-PWS-95/(\d\.\d+)$">
     <description>Microsoft Personal Web Server for Windows 95</description>
-    <example>Microsoft-PWS-95/4.0</example>
+    <example service.version="4.0">Microsoft-PWS-95/4.0</example>
     <param pos="0" name="service.vendor" value="Microsoft"/>
     <param pos="0" name="service.family" value="PWS"/>
     <param pos="0" name="service.product" value="PWS"/>
@@ -469,8 +469,8 @@
 
   <fingerprint pattern="^Apache[ -]Coyote/(\d\.\d)$">
     <description>HTTP connector for Apache Tomcat to run as a standalone HTTP server - Coyote variant</description>
-    <example>Apache-Coyote/1.1</example>
-    <example>Apache Coyote/1.0</example>
+    <example service.component.version="1.1">Apache-Coyote/1.1</example>
+    <example service.component.version="1.0">Apache Coyote/1.0</example>
     <param pos="0" name="service.vendor" value="Apache"/>
     <param pos="0" name="service.product" value="Tomcat"/>
     <param pos="0" name="service.family" value="Tomcat"/>
@@ -568,10 +568,10 @@
 
   <fingerprint pattern="^Tomcat Web Server/(\d\.[\dA-Z.]+)(?: Final)?(?:\s\(([^\)]+)\))?$">
     <description>HTTP connector for Apache Tomcat to run as a standalone HTTP server</description>
-    <example>Tomcat Web Server/3.2.2 (JSP 1.1; Servlet 2.2; Java 1.3.1; Windows 2000 5.0 x86; java.vendor=Sun Microsystems Inc.)</example>
-    <example>Tomcat Web Server/3.2.2 (JSP 1.1; Servlet 2.2; Java 1.4.2_13; Windows 2003 5.2 x86; java.vendor=Sun Microsystems Inc.)</example>
-    <example>Tomcat Web Server/3.1M1 (JSP 1.1; Servlet 2.2; Java 1.3.1; AIX 5.3 ppc; java.vendor=IBM Corporation)</example>
-    <example>Tomcat Web Server/3.3.1 Final ( JSP 1.1; Servlet 2.2 )</example>
+    <example service.version="3.2.2" tomcat.info="JSP 1.1; Servlet 2.2; Java 1.3.1; Windows 2000 5.0 x86; java.vendor=Sun Microsystems Inc.">Tomcat Web Server/3.2.2 (JSP 1.1; Servlet 2.2; Java 1.3.1; Windows 2000 5.0 x86; java.vendor=Sun Microsystems Inc.)</example>
+    <example service.version="3.2.2" tomcat.info="JSP 1.1; Servlet 2.2; Java 1.4.2_13; Windows 2003 5.2 x86; java.vendor=Sun Microsystems Inc.">Tomcat Web Server/3.2.2 (JSP 1.1; Servlet 2.2; Java 1.4.2_13; Windows 2003 5.2 x86; java.vendor=Sun Microsystems Inc.)</example>
+    <example service.version="3.1M1" tomcat.info="JSP 1.1; Servlet 2.2; Java 1.3.1; AIX 5.3 ppc; java.vendor=IBM Corporation">Tomcat Web Server/3.1M1 (JSP 1.1; Servlet 2.2; Java 1.3.1; AIX 5.3 ppc; java.vendor=IBM Corporation)</example>
+    <example service.version="3.3.1" tomcat.info=" JSP 1.1; Servlet 2.2 ">Tomcat Web Server/3.3.1 Final ( JSP 1.1; Servlet 2.2 )</example>
     <param pos="0" name="service.vendor" value="Apache"/>
     <param pos="0" name="service.product" value="Tomcat"/>
     <param pos="0" name="service.family" value="Tomcat"/>
@@ -618,7 +618,7 @@
 
   <fingerprint pattern="^Oracle Application Server Containers for J2EE 10g \(([\d.]+)\)$">
     <description>Oracle Application Server Containers for J2EE 10g</description>
-    <example>Oracle Application Server Containers for J2EE 10g (9.0.4.0.0)</example>
+    <example service.version="9.0.4.0.0">Oracle Application Server Containers for J2EE 10g (9.0.4.0.0)</example>
     <param pos="0" name="service.vendor" value="Oracle"/>
     <param pos="0" name="service.product" value="Oracle Application Server Containers"/>
     <param pos="0" name="service.family" value="Oracle"/>
@@ -635,7 +635,7 @@
 
   <fingerprint pattern="^Oracle Application Server/10g \(([\d.]+)\) Apache/([12][\d.]+)\s*(.*)$">
     <description>Oracle Application Server 10g with Apache info (powered by Apache)</description>
-    <example>Oracle Application Server/10g (10.1.2) Apache/1.3.34 (Unix) mod_perl/1.29 mod_jk/1.2.14 OracleAS-Web-Cache-10g/10.1.2.0.2 (N;ecid=119642322340,0)</example>
+    <example service.version="1.3.34" apache.info="(Unix) mod_perl/1.29 mod_jk/1.2.14 OracleAS-Web-Cache-10g/10.1.2.0.2 (N;ecid=119642322340,0)" apache.variant.version="10.1.2">Oracle Application Server/10g (10.1.2) Apache/1.3.34 (Unix) mod_perl/1.29 mod_jk/1.2.14 OracleAS-Web-Cache-10g/10.1.2.0.2 (N;ecid=119642322340,0)</example>
     <param pos="0" name="service.vendor" value="Apache"/>
     <param pos="0" name="service.product" value="HTTPD"/>
     <param pos="0" name="service.family" value="Apache"/>
@@ -648,27 +648,32 @@
 
   <!-- TODO: this needs to be improved -->
 
-  <fingerprint pattern="^Oracle-Application-Server-\d+[ig](?:[ /]([\d.]+) (?:\(.*\)|Oracle-HTTP-Server\s*(.*)))?$">
-    <description>Oracle Application Server 10g (powered by Apache)</description>
-    <example>Oracle-Application-Server-11g</example>
+  <fingerprint pattern="^Oracle-Application-Server-\d+[cgi](?:(?:[ /]([\d.]+))?\s*((?:Oracle-HTTP-Server|Oracle-Web-Cache-|OracleAS-Web-Cache-)?.{0,512})?(?:\s*\([TF]?[HSUGMN]?(?:;max-age=\d+(?:\+\d+)?)?(?:;age=\d+)?;ecid=[^)]+\))?)?$">
+    <description>Oracle Application Server</description>
     <example>Oracle-Application-Server-10g</example>
-    <example>Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server</example>
-    <example>Oracle-Application-Server-10g/10.1.2.2.0 Oracle-HTTP-Server (Unix) mod_plsql/10.1.2.2.0 mod_ossl/10.1.2.0.0 mod_perl/1.29 OracleAS-Web-Cache-10g/10.1.2.0.2 (N;ecid=89116016562,0)</example>
-    <example>Oracle-Application-Server-10g/10.1.2.2.0 Oracle-HTTP-Server OracleAS-Web-Cache-10g/10.1.2.2.0 (N;ecid=153541209221,0)</example>
-    <example>Oracle-Application-Server-10g/9.0.4.1.0 Oracle-HTTP-Server</example>
-    <param pos="0" name="service.vendor" value="Apache"/>
-    <param pos="0" name="service.product" value="HTTPD"/>
-    <param pos="0" name="service.family" value="Apache"/>
-    <param pos="0" name="service.cpe23" value="cpe:/a:apache:http_server:-"/>
-    <param pos="2" name="apache.info"/>
+    <example>Oracle-Application-Server-11g</example>
+    <example>Oracle-Application-Server-12c</example>
+    <example service.version="10.2.3.6.0">Oracle-Application-Server-11g/10.2.3.6.0</example>
+    <example service.version="10.1.2.0.2">Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server</example>
+    <example service.version="10.1.2.2.0" apache.info="Oracle-HTTP-Server (Unix) mod_plsql/10.1.2.2.0 mod_ossl/10.1.2.0.0 mod_perl/1.29 OracleAS-Web-Cache-10g/10.1.2.0.2 (N;ecid=89116016562,0)">Oracle-Application-Server-10g/10.1.2.2.0 Oracle-HTTP-Server (Unix) mod_plsql/10.1.2.2.0 mod_ossl/10.1.2.0.0 mod_perl/1.29 OracleAS-Web-Cache-10g/10.1.2.0.2 (N;ecid=89116016562,0)</example>
+    <example service.version="10.1.2.2.0" apache.info="Oracle-HTTP-Server OracleAS-Web-Cache-10g/10.1.2.2.0 (N;ecid=153541209221,0)">Oracle-Application-Server-10g/10.1.2.2.0 Oracle-HTTP-Server OracleAS-Web-Cache-10g/10.1.2.2.0 (N;ecid=153541209221,0)</example>
+    <example service.version="9.0.4.1.0">Oracle-Application-Server-10g/9.0.4.1.0 Oracle-HTTP-Server</example>
+    <example apache.info="Oracle-Web-Cache-11g/11.1.1.3.0">Oracle-Application-Server-11g Oracle-Web-Cache-11g/11.1.1.3.0</example>
+    <example apache.info="OracleAS-Web-Cache-10g/9.0.4.0.0 (G;max-age=405077281+0;age=0)">Oracle-Application-Server-10g OracleAS-Web-Cache-10g/9.0.4.0.0 (G;max-age=405077281+0;age=0)</example>
+    <example apache.info="(N;ecid=7862868532763,0:1)">Oracle-Application-Server-11g   (N;ecid=7862868532763,0:1)</example>
+    <example apache.info="Oracle-Web-Cache-11g/11.1.1.6.0 (G;max-age=0+0;age=0;ecid=9345078839670331,0:1)">Oracle-Application-Server-11g Oracle-Web-Cache-11g/11.1.1.6.0 (G;max-age=0+0;age=0;ecid=9345078839670331,0:1)</example>
+    <param pos="0" name="service.vendor" value="Oracle"/>
+    <param pos="0" name="service.product" value="Application Server"/>
     <param pos="0" name="apache.variant" value="Oracle"/>
-    <param pos="1" name="apache.variant.version"/>
+    <param pos="1" name="service.version"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:oracle:application_server:{service.version}"/>
+    <param pos="2" name="apache.info"/>
   </fingerprint>
 
   <fingerprint pattern="^Oracle9iAS/([\d.]+) Oracle HTTP Server\s*(.*)$">
     <description>Oracle 9i Application Server</description>
-    <example>Oracle9iAS/9.0.2.3.0 Oracle HTTP Server Oracle9iAS-Web-Cache/9.0.2.3.0 (N)</example>
-    <example>Oracle9iAS/9.0.3.1 Oracle HTTP Server Oracle9iAS-Web-Cache/9.0.3.1.0 (N)</example>
+    <example apache.info="Oracle9iAS-Web-Cache/9.0.2.3.0 (N)" apache.variant.version="9.0.2.3.0">Oracle9iAS/9.0.2.3.0 Oracle HTTP Server Oracle9iAS-Web-Cache/9.0.2.3.0 (N)</example>
+    <example apache.info="Oracle9iAS-Web-Cache/9.0.3.1.0 (N)" apache.variant.version="9.0.3.1">Oracle9iAS/9.0.3.1 Oracle HTTP Server Oracle9iAS-Web-Cache/9.0.3.1.0 (N)</example>
     <param pos="0" name="service.vendor" value="Apache"/>
     <param pos="0" name="service.product" value="HTTPD"/>
     <param pos="0" name="service.family" value="Apache"/>
@@ -680,9 +685,9 @@
 
   <fingerprint pattern="^Oracle HTTP Server Powered by Apache/([12][\d.]*)\s*(.*)$">
     <description>Oracle HTTP Server (powered by Apache) - version string variant</description>
-    <example>Oracle HTTP Server Powered by Apache/1.3.12 (Unix) ApacheJServ/1.1 mod_ssl/2.6.4 OpenSSL/0.9.5a</example>
-    <example>Oracle HTTP Server Powered by Apache/1.3.19 (Unix) mod_plsql/3.0.9.8.3b PHP/4.3.10 mod_fastcgi/2.2.10 mod_perl/1.25 mod_oprocmgr/1.0</example>
-    <example>Oracle HTTP Server Powered by Apache/1.3.19 (Win32) mod_ssl/2.8.1 OpenSSL/0.9.5a mod_fastcgi/2.2.10 mod_oprocmgr/1.0 mod_perl/1.25</example>
+    <example service.version="1.3.12" apache.info="(Unix) ApacheJServ/1.1 mod_ssl/2.6.4 OpenSSL/0.9.5a">Oracle HTTP Server Powered by Apache/1.3.12 (Unix) ApacheJServ/1.1 mod_ssl/2.6.4 OpenSSL/0.9.5a</example>
+    <example service.version="1.3.19" apache.info="(Unix) mod_plsql/3.0.9.8.3b PHP/4.3.10 mod_fastcgi/2.2.10 mod_perl/1.25 mod_oprocmgr/1.0">Oracle HTTP Server Powered by Apache/1.3.19 (Unix) mod_plsql/3.0.9.8.3b PHP/4.3.10 mod_fastcgi/2.2.10 mod_perl/1.25 mod_oprocmgr/1.0</example>
+    <example service.version="1.3.19" apache.info="(Win32) mod_ssl/2.8.1 OpenSSL/0.9.5a mod_fastcgi/2.2.10 mod_oprocmgr/1.0 mod_perl/1.25">Oracle HTTP Server Powered by Apache/1.3.19 (Win32) mod_ssl/2.8.1 OpenSSL/0.9.5a mod_fastcgi/2.2.10 mod_oprocmgr/1.0 mod_perl/1.25</example>
     <param pos="0" name="service.vendor" value="Apache"/>
     <param pos="0" name="service.product" value="HTTPD"/>
     <param pos="0" name="service.family" value="Apache"/>
@@ -702,9 +707,26 @@
     <param pos="0" name="apache.variant" value="Oracle"/>
   </fingerprint>
 
-  <fingerprint pattern="^Oracle-Web-Cache-11g/([\d.]+) \(N;ecid=[^)]+\)$">
+  <fingerprint pattern="^Oracle-HTTP-Server(?:(?:-(?:\d{2}[cg]\/?)?([\d.]+)?(?:\/[\d.]+)?)?(?:.{0,512}\([TF]?[HSUGMN]?(?:;max-age=\d+(?:\+\d+)?)?(?:;age=\d+)?;ecid=[^)]+\))?)?$">
+    <description>Oracle HTTP Server</description>
+    <example>Oracle-HTTP-Server</example>
+    <example>Oracle-HTTP-Server-11g</example>
+    <example>Oracle-HTTP-Server-12c</example>
+    <example service.version="12.1.3.0.0">Oracle-HTTP-Server-12c/12.1.3.0.0</example>
+    <example service.version="12.2.1.4.0">Oracle-HTTP-Server-12.2.1.4.0/2.4.39</example>
+    <example>Oracle-HTTP-Server-11g Oracle-Web-Cache-11g/11.1.1.9.0 (H;max-age=214748356+0;age=61086;ecid=32073608106620,0:1)</example>
+    <param pos="0" name="service.vendor" value="Oracle"/>
+    <param pos="0" name="service.product" value="HTTP Server"/>
+    <param pos="1" name="service.version"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:oracle:http_server:{service.version}"/>
+  </fingerprint>
+
+  <fingerprint pattern="^Oracle-Web-Cache-11g/([\d.]+)(?:\s*\([TF]?[HSUGMN]?(?:;max-age=\d+(?:\+\d+)?)?(?:;age=\d+)?;ecid=[^)]+\))?$">
     <description>Oracle Web Cache</description>
-    <example service.version="11.1.1.9.0">Oracle-Web-Cache-11g/11.1.1.9.0 (N;ecid=93620137613024,0:1)</example>
+    <example service.version="11.1.1.6.0">Oracle-Web-Cache-11g/11.1.1.6.0</example>
+    <example service.version="11.1.1.6.0">Oracle-Web-Cache-11g/11.1.1.6.0 (N;ecid=8590109479546459,0:1)</example>
+    <example service.version="11.1.1.6.0">Oracle-Web-Cache-11g/11.1.1.6.0 (G;max-age=0+0;age=0;ecid=86359748033185402,0:1:1)</example>
+    <example service.version="11.1.1.9.0">Oracle-Web-Cache-11g/11.1.1.9.0 (TH;max-age=60+30;age=55;ecid=23248098121,0)</example>
     <param pos="0" name="service.vendor" value="Oracle"/>
     <param pos="0" name="service.product" value="Web Cache"/>
     <param pos="1" name="service.version"/>
@@ -720,10 +742,36 @@
     <param pos="0" name="service.cpe23" value="cpe:/a:oracle:application_server_web_cache:{service.version}"/>
   </fingerprint>
 
+  <fingerprint pattern="^Oracle-iPlanet-Web-Server/([\d.]+)$">
+    <description>Oracle iPlanet Web Server (formerly known as Sun Java System Web Server, Sun ONE Web Server)</description>
+    <example service.version="7.0">Oracle-iPlanet-Web-Server/7.0</example>
+    <param pos="0" name="service.vendor" value="Oracle"/>
+    <param pos="0" name="service.product" value="iPlanet Web Server"/>
+    <param pos="1" name="service.version"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:oracle:iplanet_web_server:{service.version}"/>
+  </fingerprint>
+
+  <fingerprint pattern="^Oracle-ILOM-Web-Server/([\d.]+)$">
+    <description>Oracle(R) Integrated Lights Out Manager Web Server</description>
+    <example service.version="1.0">Oracle-ILOM-Web-Server/1.0</example>
+    <param pos="0" name="service.vendor" value="Oracle"/>
+    <param pos="0" name="service.product" value="ILOM"/>
+    <param pos="1" name="service.version"/>
+    <param pos="0" name="os.vendor" value="Oracle"/>
+    <param pos="0" name="os.family" value="ILOM"/>
+    <param pos="0" name="os.product" value="ILOM"/>
+    <param pos="0" name="os.device" value="Lights Out Management"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:oracle:integrated_lights_out_manager_firmware:-"/>
+    <param pos="0" name="hw.vendor" value="Oracle"/>
+    <param pos="0" name="hw.family" value="ILOM"/>
+    <param pos="0" name="hw.product" value="ILOM"/>
+    <param pos="0" name="hw.device" value="Lights Out Management"/>
+  </fingerprint>
+
   <fingerprint pattern="^HP Apache-based Web Server/([012][\d.]*)\s*\(Unix\)\s*(.*)$">
     <description>Apache running on HP-UX</description>
-    <example>HP Apache-based Web Server/1.3.26 (Unix) mod_ssl/2.8.9 OpenSSL/0.9.6c</example>
-    <example>HP Apache-based Web Server/1.3.26 (Unix)</example>
+    <example service.version="1.3.26" apache.info="mod_ssl/2.8.9 OpenSSL/0.9.6c">HP Apache-based Web Server/1.3.26 (Unix) mod_ssl/2.8.9 OpenSSL/0.9.6c</example>
+    <example service.version="1.3.26">HP Apache-based Web Server/1.3.26 (Unix)</example>
     <param pos="0" name="service.vendor" value="Apache"/>
     <param pos="0" name="service.product" value="HTTPD"/>
     <param pos="0" name="service.family" value="Apache"/>
@@ -739,11 +787,11 @@
 
   <fingerprint pattern="^CompaqHTTPServer/([0-9.]*)(?: HP System Management Homepage(?:/.*)?)?$">
     <description>HP/Compaq HTTP Server</description>
-    <example>CompaqHTTPServer/9.9 HP System Management Homepage/2.1.5.146</example>
-    <example>CompaqHTTPServer/9.9 HP System Management Homepage/3.0.1.73 httpd/2.2.6+</example>
-    <example>CompaqHTTPServer/9.9 HP System Management Homepage/6.0.0.96 httpd/2.2.6+</example>
-    <example>CompaqHTTPServer/9.9 HP System Management Homepage</example>
-    <example>CompaqHTTPServer/4.1</example>
+    <example service.version="9.9">CompaqHTTPServer/9.9 HP System Management Homepage/2.1.5.146</example>
+    <example service.version="9.9">CompaqHTTPServer/9.9 HP System Management Homepage/3.0.1.73 httpd/2.2.6+</example>
+    <example service.version="9.9">CompaqHTTPServer/9.9 HP System Management Homepage/6.0.0.96 httpd/2.2.6+</example>
+    <example service.version="9.9">CompaqHTTPServer/9.9 HP System Management Homepage</example>
+    <example service.version="4.1">CompaqHTTPServer/4.1</example>
     <param pos="0" name="service.vendor" value="HP"/>
     <param pos="0" name="service.product" value="HTTP"/>
     <param pos="0" name="service.family" value="Compaq HTTP Server"/>
@@ -857,9 +905,10 @@
     <description>Xiongmai Tech uc-httpd</description>
     <example service.version="1.0.0">uc-httpd 1.0.0</example>
     <example service.version="1.0.0">uc-httpd/1.0.0</example>
-    <param pos="0" name="service.vendor" value="Xiongmai Tech"/>
+    <param pos="0" name="service.vendor" value="Xiongmai Technology"/>
     <param pos="0" name="service.product" value="uc-httpd"/>
     <param pos="1" name="service.version"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:xiongmaitech:uc-httpd:{service.version}"/>
   </fingerprint>
 
   <fingerprint pattern="^micro_httpd$">
@@ -958,7 +1007,7 @@
 
   <fingerprint pattern="(?i)^Linux UPnP/1.0 Sonos/([\d\.\-a-z]+) \(ANVIL\)$">
     <description>Sonos Subwoofer Speaker</description>
-    <example>Linux UPnP/1.0 Sonos/31.3-22220 (ANVIL)</example>
+    <example hw.version="31.3-22220">Linux UPnP/1.0 Sonos/31.3-22220 (ANVIL)</example>
     <param pos="0" name="hw.vendor" value="Sonos"/>
     <param pos="0" name="hw.product" value="Sub"/>
     <param pos="0" name="hw.device" value="Network Audio"/>
@@ -1025,7 +1074,7 @@
 
   <fingerprint pattern="^Helix Server Version ([0-9.]*) \(win32\) \(RealServer compatible\)$">
     <description>RealMedia Helix Server - Windows</description>
-    <example>Helix Server Version 9.0.4.960 (win32) (RealServer compatible)</example>
+    <example service.version="9.0.4.960">Helix Server Version 9.0.4.960 (win32) (RealServer compatible)</example>
     <param pos="0" name="os.vendor" value="Microsoft"/>
     <param pos="0" name="os.family" value="Windows"/>
     <param pos="0" name="os.product" value="Windows"/>
@@ -1038,7 +1087,7 @@
 
   <fingerprint pattern="^Helix Server Version ([0-9.]*) \(linux-\S+\) \(RealServer compatible\)$">
     <description>RealMedia Helix Server - Linux</description>
-    <example>Helix Server Version 9.0.4.960 (linux-2.2-libc6-i586-server) (RealServer compatible)</example>
+    <example service.version="9.0.4.960">Helix Server Version 9.0.4.960 (linux-2.2-libc6-i586-server) (RealServer compatible)</example>
     <param pos="0" name="os.family" value="Linux"/>
     <param pos="0" name="os.product" value="Linux"/>
     <param pos="0" name="service.vendor" value="RealMedia"/>
@@ -1064,7 +1113,7 @@
 
   <fingerprint pattern="^Cougar/([0-9.]*)$">
     <description>Windows Media Services (older versions)</description>
-    <example>Cougar/9.01.01.3841</example>
+    <example service.version="9.01.01.3841">Cougar/9.01.01.3841</example>
     <param pos="0" name="os.vendor" value="Microsoft"/>
     <param pos="0" name="os.family" value="Windows"/>
     <param pos="0" name="os.product" value="Windows"/>
@@ -1077,7 +1126,7 @@
 
   <fingerprint pattern="^WMServer/([0-9.]*)$">
     <description>Windows Media Services (newer versions)</description>
-    <example>WMServer/9.1.1.3841</example>
+    <example service.version="9.1.1.3841">WMServer/9.1.1.3841</example>
     <param pos="0" name="os.vendor" value="Microsoft"/>
     <param pos="0" name="os.family" value="Windows"/>
     <param pos="0" name="os.product" value="Windows"/>
@@ -1152,7 +1201,7 @@
 
   <fingerprint pattern="^MiniServ/([0-9.]*)$">
     <description>mini_httpd</description>
-    <example>MiniServ/0.01</example>
+    <example service.version="0.01">MiniServ/0.01</example>
     <param pos="0" name="service.product" value="HTTP"/>
     <param pos="0" name="service.family" value="WebServer"/>
     <param pos="1" name="service.version"/>
@@ -1160,7 +1209,7 @@
 
   <fingerprint pattern="^IBM HTTP Server/(V\d+R\d+M\d+)$">
     <description>IBM HTTP server running on AS/400</description>
-    <example>IBM HTTP Server/V5R3M0</example>
+    <example os.version="V5R3M0">IBM HTTP Server/V5R3M0</example>
     <param pos="0" name="service.vendor" value="IBM"/>
     <param pos="0" name="service.product" value="HTTP Server"/>
     <param pos="0" name="service.family" value="HTTP Server"/>
@@ -1175,16 +1224,16 @@
 
   <fingerprint pattern="^(?:IBM_HTTP_Server|IBM_HTTP_SERVER)/([\w.-]+)\s+Apache/([12][\d.]+)\s*(.*)$">
     <description>IBM HTTP Server</description>
-    <example>IBM_HTTP_SERVER/1.3.19.2  Apache/1.3.20 (Win32)</example>
-    <example>IBM_HTTP_SERVER/1.3.28.1-PK16139  Apache/1.3.28 (Unix)</example>
-    <example>IBM_HTTP_Server/1.3.12 Apache/1.3.12 (Unix)</example>
-    <example>IBM_HTTP_Server/2.0.42.2-PK25355 Apache/2.0.47 (Unix) DAV/2</example>
-    <example>IBM_HTTP_Server/2.0.47.1-PK01070 Apache/2.0.47 (Win32) PHP/5.0.4</example>
-    <example>IBM_HTTP_Server/2.0.47.1 Apache/2.0.47 (Unix) DAV/2 PHP/4.3.8</example>
-    <example>IBM_HTTP_Server/6.0 Apache/2.0.47 (Unix) DAV/2</example>
-    <example>IBM_HTTP_Server/6.0.2 Apache/2.0.47 (Unix)</example>
-    <example>IBM_HTTP_Server/6.0.2.19 Apache/2.0.47 (Unix)</example>
-    <example>IBM_HTTP_Server/6.1 Apache/2.0.47 (Win32) PHP/5.1.1</example>
+    <example service.version="1.3.20" apache.info="(Win32)" apache.variant.version="1.3.19.2">IBM_HTTP_SERVER/1.3.19.2  Apache/1.3.20 (Win32)</example>
+    <example service.version="1.3.28" apache.info="(Unix)" apache.variant.version="1.3.28.1-PK16139">IBM_HTTP_SERVER/1.3.28.1-PK16139  Apache/1.3.28 (Unix)</example>
+    <example service.version="1.3.12" apache.info="(Unix)" apache.variant.version="1.3.12">IBM_HTTP_Server/1.3.12 Apache/1.3.12 (Unix)</example>
+    <example service.version="2.0.47" apache.info="(Unix) DAV/2" apache.variant.version="2.0.42.2-PK25355">IBM_HTTP_Server/2.0.42.2-PK25355 Apache/2.0.47 (Unix) DAV/2</example>
+    <example service.version="2.0.47" apache.info="(Win32) PHP/5.0.4" apache.variant.version="2.0.47.1-PK01070">IBM_HTTP_Server/2.0.47.1-PK01070 Apache/2.0.47 (Win32) PHP/5.0.4</example>
+    <example service.version="2.0.47" apache.info="(Unix) DAV/2 PHP/4.3.8" apache.variant.version="2.0.47.1">IBM_HTTP_Server/2.0.47.1 Apache/2.0.47 (Unix) DAV/2 PHP/4.3.8</example>
+    <example service.version="2.0.47" apache.info="(Unix) DAV/2" apache.variant.version="6.0">IBM_HTTP_Server/6.0 Apache/2.0.47 (Unix) DAV/2</example>
+    <example service.version="2.0.47" apache.info="(Unix)" apache.variant.version="6.0.2">IBM_HTTP_Server/6.0.2 Apache/2.0.47 (Unix)</example>
+    <example service.version="2.0.47" apache.info="(Unix)" apache.variant.version="6.0.2.19">IBM_HTTP_Server/6.0.2.19 Apache/2.0.47 (Unix)</example>
+    <example service.version="2.0.47" apache.info="(Win32) PHP/5.1.1" apache.variant.version="6.1">IBM_HTTP_Server/6.1 Apache/2.0.47 (Win32) PHP/5.1.1</example>
     <param pos="0" name="service.vendor" value="Apache"/>
     <param pos="0" name="service.product" value="HTTPD"/>
     <param pos="0" name="service.family" value="Apache"/>
@@ -1197,8 +1246,8 @@
 
   <fingerprint pattern="(?i)^(?:IBM_HTTP_SERVER|IBM-HTTP-SERVER)/(\S+)(?: \(\S+\))?$">
     <description>IBM HTTP Server with hardly useful version info</description>
-    <example>IBM-HTTP-Server/1.0</example>
-    <example>IBM_HTTP_Server/7.0.0.9 (Unix)</example>
+    <example apache.variant.version="1.0">IBM-HTTP-Server/1.0</example>
+    <example apache.variant.version="7.0.0.9">IBM_HTTP_Server/7.0.0.9 (Unix)</example>
     <param pos="0" name="service.vendor" value="Apache"/>
     <param pos="0" name="service.product" value="HTTPD"/>
     <param pos="0" name="service.family" value="Apache"/>
@@ -1222,8 +1271,9 @@
    Netscape/Sun's Application Server
    -->
 
-  <fingerprint pattern="^Sun[ -]Java[ -]System[ /]Application[ -]Server( \d\.[\d_]+)?$">
+  <fingerprint pattern="^Sun[ -]Java[ -]System[ /]Application[ -]Server(?:\s+(\d\.[\d_]+))?$">
     <description>Sun Java System Application Server (formerly iPlanet Application Server, Sun ONE Application Server)</description>
+    <example service.version="9.1_02">Sun Java System Application Server 9.1_02</example>
     <example>Sun-Java-System/Application-Server</example>
     <param pos="0" name="service.vendor" value="Sun"/>
     <param pos="0" name="service.family" value="Java System Application Server"/>
@@ -1234,7 +1284,7 @@
 
   <fingerprint pattern="^Sun[ -]Java[ -]System[ /]Application[ -]Server Platform Edition (\d\.[\d_]+)?$">
     <description>Sun Java System Application Server Platform Edition(formerly iPlanet Application Server, Sun ONE Application Server)</description>
-    <example>Sun Java System Application Server Platform Edition 9.0</example>
+    <example service.version="9.0">Sun Java System Application Server Platform Edition 9.0</example>
     <example service.version="9.0_01">Sun Java System Application Server Platform Edition 9.0_01</example>
     <param pos="0" name="service.vendor" value="Sun"/>
     <param pos="0" name="service.family" value="Java System Application Server"/>
@@ -1283,9 +1333,9 @@
 
   <fingerprint pattern="^Netscape-Enterprise/(\d+\.[\w\s.]+)$">
     <description>Netscape Enterprise Server (subsequently iPlanet Web Server, Sun ONE Web Server, presently Sun Java System Web Server)</description>
-    <example>Netscape-Enterprise/3.5.1</example>
-    <example>Netscape-Enterprise/3.6 SP3</example>
-    <example>Netscape-Enterprise/6.0</example>
+    <example service.version="3.5.1">Netscape-Enterprise/3.5.1</example>
+    <example service.version="3.6 SP3">Netscape-Enterprise/3.6 SP3</example>
+    <example service.version="6.0">Netscape-Enterprise/6.0</example>
     <param pos="0" name="service.vendor" value="Sun"/>
     <param pos="0" name="service.family" value="Java System Web Server"/>
     <param pos="0" name="service.product" value="Java System Web Server"/>
@@ -1318,7 +1368,7 @@
 
   <fingerprint pattern="^iPlanet-Web-Proxy-Server/(.*)$">
     <description>iPlanet WebProxy Server (subsequently Sun ONE WebProxy Server, presently Sun Java System Web Proxy Server)</description>
-    <example>iPlanet-Web-Proxy-Server/3.6</example>
+    <example service.version="3.6">iPlanet-Web-Proxy-Server/3.6</example>
     <example service.version="3.6-SP5">iPlanet-Web-Proxy-Server/3.6-SP5</example>
     <param pos="0" name="service.vendor" value="Sun"/>
     <param pos="0" name="service.family" value="Java System Web Proxy Server"/>
@@ -1339,8 +1389,8 @@
 
   <fingerprint pattern="^Sun-Java-System-Web-Proxy-Server/(\d\.[\d.]+)$">
     <description>Sun Java System Web Proxy Server (formerly iPlanet WebProxy Server, Sun ONE WebProxy Server)</description>
-    <example>Sun-Java-System-Web-Proxy-Server/4.0.2</example>
-    <example>Sun-Java-System-Web-Proxy-Server/4.0</example>
+    <example service.version="4.0.2">Sun-Java-System-Web-Proxy-Server/4.0.2</example>
+    <example service.version="4.0">Sun-Java-System-Web-Proxy-Server/4.0</example>
     <param pos="0" name="service.vendor" value="Sun"/>
     <param pos="0" name="service.family" value="Java System Web Proxy Server"/>
     <param pos="0" name="service.product" value="Java System Web Proxy Server"/>
@@ -1461,7 +1511,7 @@
     <example>thttpd</example>
     <example service.version="2.04">thttpd/2.04 10aug98</example>
     <example service.version="2.20b">thttpd/2.20b</example>
-    <example>thttpd/2.21b PHP/20030920</example>
+    <example service.version="2.21b">thttpd/2.21b PHP/20030920</example>
     <example service.version="2.23beta1">thttpd/2.23beta1 26may2002</example>
     <param pos="0" name="service.vendor" value="ACME"/>
     <param pos="0" name="service.product" value="thttpd"/>
@@ -1475,7 +1525,7 @@
     <example>lighttpd</example>
     <example>Lighttpd</example>
     <example service.version="1.4.16">lighttpd/1.4.16</example>
-    <example>lighttpd/1.3.7 (Mar 23 2007/16:00:15)</example>
+    <example service.version="1.3.7">lighttpd/1.3.7 (Mar 23 2007/16:00:15)</example>
     <param pos="0" name="service.vendor" value="lighttpd"/>
     <param pos="0" name="service.product" value="lighttpd"/>
     <param pos="0" name="service.family" value="lighttpd"/>
@@ -1489,20 +1539,43 @@
     <param pos="0" name="service.product" value="nginx"/>
     <param pos="0" name="service.family" value="nginx"/>
     <param pos="0" name="service.vendor" value="nginx"/>
-    <param pos="0" name="service.cpe23" value="cpe:/a:nginx:nginx:-"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:f5:nginx:-"/>
   </fingerprint>
 
   <fingerprint pattern="^nginx\/?([\d.]+)?">
     <description>nginx with version info and/or mods</description>
     <example service.version="0.8.53">nginx/0.8.53 + Phusion Passenger 3.0.0 (mod_rails/mod_rack)</example>
-    <example>nginx/0.8.53</example>
+    <example service.version="0.8.53">nginx/0.8.53</example>
     <example>nginx + Phusion Passenger 5.1.11</example>
     <example>nginx + Phusion Passenger</example>
     <param pos="0" name="service.product" value="nginx"/>
     <param pos="0" name="service.family" value="nginx"/>
     <param pos="0" name="service.vendor" value="nginx"/>
     <param pos="1" name="service.version"/>
-    <param pos="0" name="service.cpe23" value="cpe:/a:nginx:nginx:{service.version}"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:f5:nginx:{service.version}"/>
+  </fingerprint>
+
+  <fingerprint pattern="^TeamSpeak Server ([\d.]+)$">
+    <description>TeamSpeak HTTP server</description>
+    <example service.version="3.13.6">TeamSpeak Server 3.13.6</example>
+    <example service.version="3.13.3">TeamSpeak Server 3.13.3</example>
+    <param pos="0" name="service.vendor" value="TeamSpeak"/>
+    <param pos="0" name="service.product" value="TeamSpeak"/>
+    <param pos="1" name="service.version"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:teamspeak:teamspeak:{service.version}"/>
+  </fingerprint>
+
+  <fingerprint pattern="^WebSocket\+\+/([\d.-]+(?:-dev)?)$">
+    <description>WebSocket++ web server - https://github.com/zaphoyd/websocketpp</description>
+    <example service.version="0.8.1">WebSocket++/0.8.1</example>
+    <example service.version="0.8.2">WebSocket++/0.8.2</example>
+    <example service.version="0.4.0">WebSocket++/0.4.0</example>
+    <example service.version="0.8.0-dev">WebSocket++/0.8.0-dev</example>
+    <example service.version="2011-09-25">WebSocket++/2011-09-25</example>
+    <param pos="0" name="service.vendor" value="Zaphoyd Studios"/>
+    <param pos="0" name="service.product" value="WebSocket++"/>
+    <param pos="1" name="service.version"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:zaphoyd:websocketpp:{service.version}"/>
   </fingerprint>
 
   <fingerprint pattern="^Lotus(?:-Domino)?(?:/|/0|/Release)?$">
@@ -1519,8 +1592,8 @@
 
   <fingerprint pattern="^Lotus(?:-Domino)?/(?:Release-?)?([4-7][\d.]+)\s*(?:.*)$">
     <description>IBM Lotus Notes/Domino with version info</description>
-    <example>Lotus-Domino/5.0.8</example>
-    <example>Lotus-Domino/Release-4.6.7(Intl)</example>
+    <example service.version="5.0.8">Lotus-Domino/5.0.8</example>
+    <example service.version="4.6.7">Lotus-Domino/Release-4.6.7(Intl)</example>
     <param pos="0" name="service.vendor" value="IBM"/>
     <param pos="0" name="service.product" value="Lotus Domino"/>
     <param pos="0" name="service.family" value="Lotus Domino"/>
@@ -1553,9 +1626,9 @@
 
   <fingerprint pattern="^Resin/(\S+)$">
     <description>Caucho Resin</description>
-    <example>Resin/2.1.13</example>
-    <example>Resin/3.0.23</example>
-    <example>Resin/2.1.s030827</example>
+    <example service.version="2.1.13">Resin/2.1.13</example>
+    <example service.version="3.0.23">Resin/3.0.23</example>
+    <example service.version="2.1.s030827">Resin/2.1.s030827</example>
     <param pos="0" name="service.vendor" value="Caucho"/>
     <param pos="0" name="service.product" value="Resin"/>
     <param pos="0" name="service.family" value="Resin"/>
@@ -1565,9 +1638,9 @@
 
   <fingerprint pattern="^Ipswitch-IMail/(\d\.\d+)$">
     <description>Ipswitch IMail Server</description>
-    <example>Ipswitch-IMail/5.08</example>
-    <example>Ipswitch-IMail/7.07</example>
-    <example>Ipswitch-IMail/8.05</example>
+    <example service.version="5.08">Ipswitch-IMail/5.08</example>
+    <example service.version="7.07">Ipswitch-IMail/7.07</example>
+    <example service.version="8.05">Ipswitch-IMail/8.05</example>
     <param pos="0" name="service.vendor" value="Ipswitch"/>
     <param pos="0" name="service.product" value="IMail Server"/>
     <param pos="0" name="service.family" value="IMail Server"/>
@@ -1623,7 +1696,7 @@
 
   <fingerprint pattern="^Abyss/(\d\.[\d.]+)-X2-Win32 AbyssLib/(?:\d\.[\d.]+)$">
     <description>Aprelium Technologies Abyss Web Server X2 (licensed professional edition) on Windows</description>
-    <example>Abyss/2.14.2-X2-Win32 AbyssLib/2.14</example>
+    <example service.version="2.14.2">Abyss/2.14.2-X2-Win32 AbyssLib/2.14</example>
     <param pos="0" name="service.vendor" value="Aprelium Technologies"/>
     <param pos="0" name="service.product" value="Abyss Web Server X2"/>
     <param pos="0" name="service.family" value="Abyss Web Server"/>
@@ -1671,7 +1744,7 @@
 
   <fingerprint pattern="^NetWare-Enterprise-Web-Server/(\d+\.\d+)$">
     <description>NetWare Enterprise Web Server (runs on NetWare 5.1)</description>
-    <example service.version="5.1">NetWare-Enterprise-Web-Server/5.1</example>
+    <example service.version="5.1" os.version="5.1">NetWare-Enterprise-Web-Server/5.1</example>
     <param pos="0" name="service.vendor" value="Novell"/>
     <param pos="0" name="service.product" value="NetWare Enterprise Web Server"/>
     <param pos="0" name="service.family" value="NetWare Enterprise Web Server"/>
@@ -1903,11 +1976,11 @@
   <fingerprint pattern="^NetCache appliance \(NetApp/+(\d+\.\d+[\w.]+)\)$">
     <description>NetCache appliance (product line formerly owned by Network Appliances, now owned by Blue Coat Systems).</description>
     <example service.version="5.3.1R3">NetCache appliance (NetApp/5.3.1R3)</example>
-    <example>NetCache appliance (NetApp/5.4R2D2)</example>
-    <example>NetCache appliance (NetApp/5.6.1D22)</example>
-    <example>NetCache appliance (NetApp/6.0.2P1)</example>
-    <example>NetCache appliance (NetApp/6.0.4)</example>
-    <example>NetCache appliance (NetApp/6.1RC2)</example>
+    <example service.version="5.4R2D2">NetCache appliance (NetApp/5.4R2D2)</example>
+    <example service.version="5.6.1D22">NetCache appliance (NetApp/5.6.1D22)</example>
+    <example service.version="6.0.2P1">NetCache appliance (NetApp/6.0.2P1)</example>
+    <example service.version="6.0.4">NetCache appliance (NetApp/6.0.4)</example>
+    <example service.version="6.1RC2">NetCache appliance (NetApp/6.1RC2)</example>
     <param pos="0" name="service.vendor" value="Blue Coat"/>
     <param pos="0" name="service.family" value="NetCache"/>
     <param pos="0" name="service.product" value="NetCache"/>
@@ -1920,9 +1993,9 @@
 
   <fingerprint pattern="^NetApp/+(.*)$">
     <description>NetApp file servers</description>
-    <example>NetApp/7.3.4P1</example>
-    <example>NetApp/7.2.1.1</example>
-    <example>NetApp//8.1RC2</example>
+    <example os.version="7.3.4P1">NetApp/7.3.4P1</example>
+    <example os.version="7.2.1.1">NetApp/7.2.1.1</example>
+    <example os.version="8.1RC2">NetApp//8.1RC2</example>
     <param pos="0" name="os.certainty" value="0.9"/>
     <param pos="0" name="os.vendor" value="NetApp"/>
     <param pos="0" name="os.family" value="Data ONTAP"/>
@@ -1973,8 +2046,8 @@
 
   <fingerprint pattern="^HP-Chai(?:Server|SOE)/(\d+\.\d+)$">
     <description>HP Printer running the Chai embedded web server</description>
-    <example>HP-ChaiServer/2.2</example>
-    <example>HP-ChaiSOE/1.0</example>
+    <example service.version="2.2">HP-ChaiServer/2.2</example>
+    <example service.version="1.0">HP-ChaiSOE/1.0</example>
     <param pos="0" name="service.vendor" value="HP"/>
     <param pos="0" name="service.product" value="JetDirect"/>
     <param pos="0" name="service.family" value="JetDirect"/>
@@ -2089,7 +2162,7 @@
 
   <fingerprint pattern="^cisco-IOS/([^\s]+) HTTP-server/">
     <description>Cisco IOS with version information</description>
-    <example>cisco-IOS/12.1 HTTP-server/1.0(1)</example>
+    <example os.version="12.1">cisco-IOS/12.1 HTTP-server/1.0(1)</example>
     <param pos="0" name="service.vendor" value="Cisco"/>
     <param pos="0" name="service.family" value="IOS"/>
     <param pos="0" name="service.product" value="IOS"/>
@@ -2104,7 +2177,7 @@
 
   <fingerprint pattern="^Cisco AWARE (.*)$">
     <description>Cisco ASA</description>
-    <example>Cisco AWARE 2.0</example>
+    <example service.version="2.0">Cisco AWARE 2.0</example>
     <param pos="1" name="service.version"/>
     <param pos="0" name="service.vendor" value="Cisco"/>
     <param pos="0" name="service.product" value="HTTP"/>
@@ -2211,8 +2284,8 @@
 
   <fingerprint pattern="^(?:Raptor )?Simple, Secure Web Server ([\d.]+)$">
     <description>Symantec Raptor Firewall</description>
-    <example>Simple, Secure Web Server 1.1</example>
-    <example>Raptor Simple, Secure Web Server 1.0</example>
+    <example os.version="1.1">Simple, Secure Web Server 1.1</example>
+    <example os.version="1.0">Raptor Simple, Secure Web Server 1.0</example>
     <param pos="0" name="os.vendor" value="Symantec"/>
     <param pos="0" name="os.family" value="Raptor"/>
     <param pos="0" name="os.device" value="Firewall"/>
@@ -2310,7 +2383,7 @@
 
   <fingerprint pattern="^ListManagerWeb/(\S+)">
     <description>Lyris ListManager</description>
-    <example>ListManagerWeb/8.8a (based on Tcl-Webserver/3.4.2)</example>
+    <example service.version="8.8a">ListManagerWeb/8.8a (based on Tcl-Webserver/3.4.2)</example>
     <param pos="0" name="service.vendor" value="Lyris"/>
     <param pos="0" name="service.product" value="ListManager"/>
     <param pos="1" name="service.version"/>
@@ -2318,7 +2391,7 @@
 
   <fingerprint pattern="^kHTTPd (\S+)" certainty="0.50">
     <description>TUX web server, an in-kernel Linux HTTP Accelerator</description>
-    <example>kHTTPd 0.1.6</example>
+    <example service.version="0.1.6">kHTTPd 0.1.6</example>
     <param pos="0" name="service.product" value="TUX Web Server"/>
     <param pos="1" name="service.version"/>
     <param pos="0" name="os.vendor" value="Linux"/>
@@ -2329,8 +2402,8 @@
 
   <fingerprint pattern="^VNC Server (Enterprise|Personal) Edition/(?:E|P)([\d.]+) \(r([\d.]+)\)$">
     <description>RealVNC built-in webserver - Enterprise edition</description>
-    <example service.version="4.5.1" service.version.version="27892">VNC Server Enterprise Edition/E4.5.1 (r27892)</example>
-    <example service.edition="Personal">VNC Server Personal Edition/P4.5.3 (r39012)</example>
+    <example service.version="4.5.1" service.version.version="27892" service.edition="Enterprise">VNC Server Enterprise Edition/E4.5.1 (r27892)</example>
+    <example service.edition="Personal" service.version="4.5.3" service.version.version="39012">VNC Server Personal Edition/P4.5.3 (r39012)</example>
     <param pos="0" name="service.vendor" value="RealVNC Ltd."/>
     <param pos="0" name="service.product" value="RealVNC"/>
     <param pos="1" name="service.edition"/>
@@ -2369,7 +2442,7 @@
 
   <fingerprint pattern="^SecureTransport (\d+[\d\.]+) \(build: (\d+)\)$">
     <description>AxWay SecureTransport</description>
-    <example>SecureTransport 5.3.6 (build: 412)</example>
+    <example service.version="5.3.6" securetransport.build="412">SecureTransport 5.3.6 (build: 412)</example>
     <param pos="0" name="service.vendor" value="Axway"/>
     <param pos="0" name="service.product" value="SecureTransport"/>
     <param pos="1" name="service.version"/>
@@ -2377,24 +2450,24 @@
     <param pos="2" name="securetransport.build"/>
   </fingerprint>
 
-  <fingerprint pattern="(Agranat|Conexant|(?:Globespan)?Virata)-EmWeb/(.*)$">
+  <fingerprint pattern="(Agranat|Conexant|(?:Globespan)?Virata)-EmWeb/(R[\d_]+)$">
     <description>EmWeb variants</description>
-    <example>Agranat-EmWeb/R4_01</example>
-    <example>Agranat-EmWeb/R5_1_2</example>
-    <example>Agranat-EmWeb/R5_2_4</example>
-    <example>Agranat-EmWeb/R5_2_6</example>
-    <example>Conexant-EmWeb/R6_1_0</example>
-    <example>ISOS/9.0 UPnP/1.0 Conexant-EmWeb/R6_1_0</example>
-    <example>Nucleus/4.3 UPnP/1.0 Virata-EmWeb/R6_2_0</example>
-    <example>Unknown/0.0 UPnP/1.0 Conexant-EmWeb/R6_1_0</example>
-    <example>Unknown/0.0 UPnP/1.0 GlobespanVirata-EmWeb/R6_1_0</example>
-    <example>Unknown/0.0 UPnP/1.0 Virata-EmWeb/R6_1_0</example>
-    <example>Virata-EmWeb/R5_3_0</example>
-    <example>Virata-EmWeb/R5_3_2</example>
-    <example>Virata-EmWeb/R6_0_1</example>
-    <example>Virata-EmWeb/R6_1_0</example>
-    <example>Virata-EmWeb/R6_2_0</example>
-    <example>Virata-EmWeb/R6_2_1</example>
+    <example service.vendor="Agranat" service.version="R4_01">Agranat-EmWeb/R4_01</example>
+    <example service.vendor="Agranat" service.version="R5_1_2">Agranat-EmWeb/R5_1_2</example>
+    <example service.vendor="Agranat" service.version="R5_2_4">Agranat-EmWeb/R5_2_4</example>
+    <example service.vendor="Agranat" service.version="R5_2_6">Agranat-EmWeb/R5_2_6</example>
+    <example service.vendor="Conexant" service.version="R6_1_0">Conexant-EmWeb/R6_1_0</example>
+    <example service.vendor="Conexant" service.version="R6_1_0">ISOS/9.0 UPnP/1.0 Conexant-EmWeb/R6_1_0</example>
+    <example service.vendor="Virata" service.version="R6_2_0">Nucleus/4.3 UPnP/1.0 Virata-EmWeb/R6_2_0</example>
+    <example service.vendor="Conexant" service.version="R6_1_0">Unknown/0.0 UPnP/1.0 Conexant-EmWeb/R6_1_0</example>
+    <example service.vendor="GlobespanVirata" service.version="R6_1_0">Unknown/0.0 UPnP/1.0 GlobespanVirata-EmWeb/R6_1_0</example>
+    <example service.vendor="Virata" service.version="R6_1_0">Unknown/0.0 UPnP/1.0 Virata-EmWeb/R6_1_0</example>
+    <example service.vendor="Virata" service.version="R5_3_0">Virata-EmWeb/R5_3_0</example>
+    <example service.vendor="Virata" service.version="R5_3_2">Virata-EmWeb/R5_3_2</example>
+    <example service.vendor="Virata" service.version="R6_0_1">Virata-EmWeb/R6_0_1</example>
+    <example service.vendor="Virata" service.version="R6_1_0">Virata-EmWeb/R6_1_0</example>
+    <example service.vendor="Virata" service.version="R6_2_0">Virata-EmWeb/R6_2_0</example>
+    <example service.vendor="Virata" service.version="R6_2_1">Virata-EmWeb/R6_2_1</example>
     <param pos="1" name="service.vendor"/>
     <param pos="0" name="service.family" value="EmWeb"/>
     <param pos="0" name="service.product" value="EmWeb"/>
@@ -2468,9 +2541,9 @@
   <fingerprint pattern="^SentinelProtectionServer/((?:\d+\.)*\d+)$">
     <description>Sentinel Protection Server - Embedded httpd in SafeNet's memory key dongles</description>
     <example service.version="7.1">SentinelProtectionServer/7.1</example>
-    <example>SentinelProtectionServer/7.3</example>
-    <example>SentinelProtectionServer/7.0</example>
-    <example>SentinelProtectionServer/7</example>
+    <example service.version="7.3">SentinelProtectionServer/7.3</example>
+    <example service.version="7.0">SentinelProtectionServer/7.0</example>
+    <example service.version="7">SentinelProtectionServer/7</example>
     <param pos="0" name="service.vendor" value="SafeNet"/>
     <param pos="0" name="service.product" value="Sentinel Protection Server"/>
     <param pos="0" name="service.family" value="Sentinel"/>
@@ -2480,8 +2553,8 @@
   <fingerprint pattern="^SentinelKeysServer/((?:\d+\.)*\d+)$">
     <description>Sentinel Key Server - Embedded httpd in SafeNet's memory key dongles</description>
     <example service.version="1.3.1">SentinelKeysServer/1.3.1</example>
-    <example>SentinelKeysServer/1.0</example>
-    <example>SentinelKeysServer/1</example>
+    <example service.version="1.0">SentinelKeysServer/1.0</example>
+    <example service.version="1">SentinelKeysServer/1</example>
     <param pos="0" name="service.vendor" value="SafeNet"/>
     <param pos="0" name="service.product" value="Sentinel Keys Server"/>
     <param pos="0" name="service.family" value="Sentinel"/>
@@ -2490,8 +2563,8 @@
 
   <fingerprint pattern="^CherryPy/((?:\d+\.)*\d+)$">
     <description>Web server component of CherryPy web application framework.</description>
-    <example>CherryPy/3.1.2</example>
-    <example>CherryPy/3</example>
+    <example service.version="3.1.2">CherryPy/3.1.2</example>
+    <example service.version="3">CherryPy/3</example>
     <param pos="0" name="service.vendor" value="CherryPy"/>
     <param pos="0" name="service.product" value="CherryPy"/>
     <param pos="0" name="service.family" value="CherryPy"/>
@@ -2501,7 +2574,7 @@
 
   <fingerprint pattern="(?i)^TornadoServer/((?:\d+\.)*\d+)$">
     <description>Tornado Python web framework and asynchronous networking library.</description>
-    <example>TornadoServer/4.0.2</example>
+    <example service.version="4.0.2">TornadoServer/4.0.2</example>
     <param pos="0" name="service.vendor" value="TornadoWeb"/>
     <param pos="0" name="service.product" value="Tornado"/>
     <param pos="0" name="service.family" value="Tornado"/>
@@ -2511,8 +2584,8 @@
 
   <fingerprint pattern="(?i)^SimpleHTTP/((?:\d+\.)*\d+)\s*Python/((?:\d+\.)*\d+)$">
     <description>SimpleHTTPRequestHandler Python class is a simple HTTP request handler.</description>
-    <example service.version="0.6">SimpleHTTP/0.6 Python/2.7.6</example>
-    <example python.version="3.4.0">SimpleHTTP/0.6 Python/3.4.0</example>
+    <example service.version="0.6" python.version="2.7.6">SimpleHTTP/0.6 Python/2.7.6</example>
+    <example python.version="3.4.0" service.version="0.6">SimpleHTTP/0.6 Python/3.4.0</example>
     <param pos="0" name="service.vendor" value="Python Software Foundation"/>
     <param pos="0" name="service.product" value="SimpleHTTP"/>
     <param pos="0" name="service.family" value="Python"/>
@@ -2522,8 +2595,8 @@
 
   <fingerprint pattern="^Python/(\d\.[\d.]+) aiohttp/(\d[\w.]+)$">
     <description>AIOHTTP Project AIOHTTP</description>
-    <example service.version="3.7.4.post0">Python/3.8 aiohttp/3.7.4.post0</example>
-    <example python.version="3.4">Python/3.4 aiohttp/1.0.5</example>
+    <example service.version="3.7.4.post0" python.version="3.8">Python/3.8 aiohttp/3.7.4.post0</example>
+    <example python.version="3.4" service.version="1.0.5">Python/3.4 aiohttp/1.0.5</example>
     <param pos="0" name="service.vendor" value="AIOHTTP Project"/>
     <param pos="0" name="service.product" value="AIOHTTP"/>
     <param pos="2" name="service.version"/>
@@ -2550,8 +2623,8 @@
 
   <fingerprint pattern="^HP Web Jetadmin/((?:\d+\.)*\d+)\s*(.*)$">
     <description>Apache variant for web access to HP printers.</description>
-    <example>HP Web Jetadmin/2.0.50 (Win32) mod_auth_sspi/1.0.1 mod_ssl/2.0.50 OpenSSL/0.9.6m</example>
-    <example>HP Web Jetadmin/2 (Win32) mod_auth_sspi/1.0.1 mod_ssl/2.0.50 OpenSSL/0.9.6m</example>
+    <example service.version="2.0.50" apache.info="(Win32) mod_auth_sspi/1.0.1 mod_ssl/2.0.50 OpenSSL/0.9.6m">HP Web Jetadmin/2.0.50 (Win32) mod_auth_sspi/1.0.1 mod_ssl/2.0.50 OpenSSL/0.9.6m</example>
+    <example service.version="2" apache.info="(Win32) mod_auth_sspi/1.0.1 mod_ssl/2.0.50 OpenSSL/0.9.6m">HP Web Jetadmin/2 (Win32) mod_auth_sspi/1.0.1 mod_ssl/2.0.50 OpenSSL/0.9.6m</example>
     <param pos="0" name="service.vendor" value="Apache"/>
     <param pos="0" name="service.product" value="HTTPD"/>
     <param pos="0" name="service.family" value="Apache"/>
@@ -2593,8 +2666,8 @@
 
   <fingerprint pattern="^ScreenConnect/([\d.]+)-(\d+)(?: Microsoft-HTTPAPI/2.0)?$">
     <description>ConnectWise Control formerly ScreenConnect</description>
-    <example service.version="6.3.13446.6374">ScreenConnect/6.3.13446.6374-4039728469 Microsoft-HTTPAPI/2.0</example>
-    <example service.version.version="3841999031">ScreenConnect/19.3.25270.7185-3841999031</example>
+    <example service.version="6.3.13446.6374" service.version.version="4039728469">ScreenConnect/6.3.13446.6374-4039728469 Microsoft-HTTPAPI/2.0</example>
+    <example service.version.version="3841999031" service.version="19.3.25270.7185">ScreenConnect/19.3.25270.7185-3841999031</example>
     <param pos="0" name="service.vendor" value="ConnectWise"/>
     <param pos="0" name="service.product" value="Control"/>
     <param pos="1" name="service.version"/>
@@ -2604,8 +2677,8 @@
 
   <fingerprint pattern="^Lotus Expeditor Web Container/((?:\d+\.)*\d+)$">
     <description>Expeditor is a framework used by IBM in many products in the Lotus brand, such as Sametime and Notes.</description>
-    <example>Lotus Expeditor Web Container/6.1</example>
-    <example>Lotus Expeditor Web Container/6</example>
+    <example service.version="6.1">Lotus Expeditor Web Container/6.1</example>
+    <example service.version="6">Lotus Expeditor Web Container/6</example>
     <param pos="0" name="service.vendor" value="IBM"/>
     <param pos="0" name="service.product" value="Lotus Expeditor Server"/>
     <param pos="0" name="service.family" value="Lotus Expeditor"/>
@@ -2630,7 +2703,7 @@
     <description>GoAhead-Webs - version</description>
     <example service.version="2.5.0">GoAhead-Webs/2.5.0 PeerSec-MatrixSSL/3.4.2-OPEN</example>
     <example service.version="2.5.0">Goahead/2.5.0 PeerSec-MatrixSSL/3.2.1-OPEN</example>
-    <example>GoAhead-Webs/2.5.0</example>
+    <example service.version="2.5.0">GoAhead-Webs/2.5.0</example>
     <param pos="0" name="service.vendor" value="Oracle"/>
     <param pos="0" name="service.product" value="GoAhead Webserver"/>
     <param pos="0" name="service.family" value="GoAhead Webserver"/>
@@ -2643,8 +2716,8 @@
     <description>Mbedthis Appweb</description>
     <example service.version="2.4.0">Mbedthis-Appweb/2.4.0</example>
     <example service.version="2.4.0">Mbedthis-AppWeb/2.4.0</example>
-    <example>Mbedthis-Appweb/2.4.2</example>
-    <example>Mbedthis-Appweb/2</example>
+    <example service.version="2.4.2">Mbedthis-Appweb/2.4.2</example>
+    <example service.version="2">Mbedthis-Appweb/2</example>
     <param pos="0" name="service.vendor" value="Mbedthis Software"/>
     <param pos="0" name="service.product" value="Appweb"/>
     <param pos="0" name="service.family" value="Appweb"/>
@@ -2665,8 +2738,8 @@
 
   <fingerprint pattern="^Avaya CMBE/((?:\d+\.)*\d+)$">
     <description>Web server for Avaya Aura Communication Manager Branch, a SIP-based communications platform.</description>
-    <example>Avaya CMBE/2.0.0</example>
-    <example>Avaya CMBE/2</example>
+    <example service.version="2.0.0">Avaya CMBE/2.0.0</example>
+    <example service.version="2">Avaya CMBE/2</example>
     <param pos="0" name="service.vendor" value="Avaya"/>
     <param pos="0" name="service.product" value="Aura Communication Manager"/>
     <param pos="0" name="service.family" value="Aura"/>
@@ -2713,7 +2786,7 @@
 
   <fingerprint pattern="^TwistedWeb/([\d.rc]+)$">
     <description>Twisted Matrix Labs - TwistedWeb</description>
-    <example>TwistedWeb/2.5.0</example>
+    <example service.version="2.5.0">TwistedWeb/2.5.0</example>
     <example service.version="16.4.0">TwistedWeb/16.4.0</example>
     <example service.version="16.5.0rc2">TwistedWeb/16.5.0rc2</example>
     <param pos="0" name="service.vendor" value="TwistedMatrix"/>
@@ -2725,8 +2798,8 @@
 
   <fingerprint pattern="^Twisted/([\d.]+) TwistedWeb/([\d.]+)$">
     <description>Twisted Matrix Labs - TwistedWeb - verbose variant</description>
-    <example service.version="13.0.0">Twisted/13.0.0 TwistedWeb/9.0.0</example>
-    <example service.version.version="9.0.0">Twisted/17.9.0 TwistedWeb/9.0.0</example>
+    <example service.version="13.0.0" service.version.version="9.0.0">Twisted/13.0.0 TwistedWeb/9.0.0</example>
+    <example service.version.version="9.0.0" service.version="17.9.0">Twisted/17.9.0 TwistedWeb/9.0.0</example>
     <param pos="0" name="service.vendor" value="TwistedMatrix"/>
     <param pos="0" name="service.product" value="Twisted Web"/>
     <param pos="0" name="service.family" value="Twisted Web"/>
@@ -2737,8 +2810,8 @@
 
   <fingerprint pattern="^mini_httpd/((?:\d+\.)*\d+) \S*$">
     <description>ACME mini_httpd with version and date</description>
-    <example>mini_httpd/1.14 23jun2000</example>
-    <example>mini_httpd/1 23jun2000</example>
+    <example service.version="1.14">mini_httpd/1.14 23jun2000</example>
+    <example service.version="1">mini_httpd/1 23jun2000</example>
     <param pos="0" name="service.vendor" value="ACME"/>
     <param pos="0" name="service.product" value="mini_httpd"/>
     <param pos="0" name="service.family" value="mini_httpd"/>
@@ -2749,7 +2822,7 @@
   <fingerprint pattern="^thin ((?:\d+\.)*\d+) codename .+$">
     <description>Marc-André Cournoyer's thin webserver</description>
     <example service.version="1.2.4">thin 1.2.4 codename Flaming Astroboy</example>
-    <example>thin 1 codename Flaming Astroboy</example>
+    <example service.version="1">thin 1 codename Flaming Astroboy</example>
     <param pos="0" name="service.product" value="Thin"/>
     <param pos="0" name="service.family" value="Thin"/>
     <param pos="1" name="service.version"/>
@@ -2757,8 +2830,8 @@
 
   <fingerprint pattern="^Avocent DSView \d+/((?:\d+\.)*\d+)$">
     <description>Web server interface for controlling data centers.</description>
-    <example>Avocent DSView 3/3.7.0.71</example>
-    <example>Avocent DSView 3/3</example>
+    <example service.version="3.7.0.71">Avocent DSView 3/3.7.0.71</example>
+    <example service.version="3">Avocent DSView 3/3</example>
     <param pos="0" name="service.vendor" value="Avocent"/>
     <param pos="0" name="service.product" value="DSView"/>
     <param pos="0" name="service.family" value="DSView"/>
@@ -2769,7 +2842,7 @@
   <fingerprint pattern="^Mongrel ((?:\d+\.)*\d+)$">
     <description>Ruby-based web server and HTTP library.</description>
     <example service.version="1.1.5">Mongrel 1.1.5</example>
-    <example>Mongrel 1</example>
+    <example service.version="1">Mongrel 1</example>
     <param pos="0" name="service.vendor" value="Zed Shaw"/>
     <param pos="0" name="service.product" value="Mongrel"/>
     <param pos="0" name="service.family" value="Mongrel"/>
@@ -2779,9 +2852,9 @@
 
   <fingerprint pattern="^Microplex emHTTPD/((?:\d+\.)*\d+)$">
     <description>Embedded web server used by Microplex.</description>
-    <example>Microplex emHTTPD/1.0</example>
-    <example>Microplex emHTTPD/1.1</example>
-    <example>Microplex emHTTPD/1</example>
+    <example service.version="1.0">Microplex emHTTPD/1.0</example>
+    <example service.version="1.1">Microplex emHTTPD/1.1</example>
+    <example service.version="1">Microplex emHTTPD/1</example>
     <param pos="0" name="service.vendor" value="Microplex"/>
     <param pos="0" name="service.product" value="emHTTPD"/>
     <param pos="0" name="service.family" value="emHTTPD"/>
@@ -2792,8 +2865,8 @@
 
   <fingerprint pattern="^UPS_Server/((?:\d+\.)*\d+)$">
     <description>An embedded web server used for UPS management; primarily by Eaton, but also by APC.</description>
-    <example>UPS_Server/1.0</example>
-    <example>UPS_Server/1</example>
+    <example service.version="1.0">UPS_Server/1.0</example>
+    <example service.version="1">UPS_Server/1</example>
     <param pos="0" name="service.vendor" value="Eaton"/>
     <param pos="0" name="service.product" value="ConnectUPS"/>
     <param pos="0" name="service.family" value="ConnectUPS"/>
@@ -2804,8 +2877,8 @@
 
   <fingerprint pattern="^JC-HTTPD/((?:\d+\.)*\d+)$">
     <description>An embedded web server, used notably by Oki and Kyocera in printers.</description>
-    <example>JC-HTTPD/1.11.14</example>
-    <example>JC-HTTPD/1</example>
+    <example service.version="1.11.14">JC-HTTPD/1.11.14</example>
+    <example service.version="1">JC-HTTPD/1</example>
     <param pos="0" name="service.product" value="JC-HTTPD"/>
     <param pos="0" name="service.family" value="JC-HTTPD"/>
     <param pos="1" name="service.version"/>
@@ -2814,7 +2887,7 @@
   <fingerprint pattern="^JC-SHTTPD/((?:\d+\.)*\d+)$">
     <description>An embedded web server.</description>
     <example service.version="1.17.20">JC-SHTTPD/1.17.20</example>
-    <example>JC-SHTTPD/1</example>
+    <example service.version="1">JC-SHTTPD/1</example>
     <param pos="0" name="service.product" value="JC-SHTTPD"/>
     <param pos="0" name="service.family" value="JC-SHTTPD"/>
     <param pos="1" name="service.version"/>
@@ -2823,7 +2896,7 @@
   <fingerprint pattern="^Oracle XML DB/Oracle\S+ (?:Enterprise Edition )?Release ((?:\d+\.)*\d+) - Production$">
     <description>Web server providing web services for Oracle's XML DB - with version string</description>
     <example service.version="9.2.0.1.0">Oracle XML DB/Oracle9i Enterprise Edition Release 9.2.0.1.0 - Production</example>
-    <example>Oracle XML DB/Oracle9i Enterprise Edition Release 9 - Production</example>
+    <example service.version="9">Oracle XML DB/Oracle9i Enterprise Edition Release 9 - Production</example>
     <example service.version="9.2.0.1.0">Oracle XML DB/Oracle9i Release 9.2.0.1.0 - Production</example>
     <param pos="0" name="service.vendor" value="Oracle"/>
     <param pos="0" name="service.product" value="XML DB"/>
@@ -2863,8 +2936,8 @@
 
   <fingerprint pattern="^Ews/((?:\d+\.)*\d+)$">
     <description>IBM Network Printer Manager.</description>
-    <example>Ews/0.1</example>
-    <example>Ews/0</example>
+    <example service.version="0.1">Ews/0.1</example>
+    <example service.version="0">Ews/0</example>
     <param pos="0" name="service.vendor" value="IBM"/>
     <param pos="0" name="service.product" value="Network Printer Manager"/>
     <param pos="0" name="service.family" value="Network Printer Manager"/>
@@ -2877,10 +2950,10 @@
 
   <fingerprint pattern="^\$ProjectRevision:[\s\w:]* ([\d\.]+) \$$">
     <description>This banner is used to see if devices have Treck TCP/IP</description>
-    <example>$ProjectRevision: 4.0.2.38 $</example>
-    <example>$ProjectRevision: 4.2 $</example>
-    <example>$ProjectRevision: 6.0.1.5 $</example>
-    <example>$ProjectRevision: Last Checkpoint: 4.2.2.13 $</example>
+    <example service.version="4.0.2.38">$ProjectRevision: 4.0.2.38 $</example>
+    <example service.version="4.2">$ProjectRevision: 4.2 $</example>
+    <example service.version="6.0.1.5">$ProjectRevision: 6.0.1.5 $</example>
+    <example service.version="4.2.2.13">$ProjectRevision: Last Checkpoint: 4.2.2.13 $</example>
     <param pos="0" name="service.vendor" value="Treck"/>
     <param pos="0" name="service.product" value="TCP/IP"/>
     <param pos="1" name="service.version"/>
@@ -2947,8 +3020,8 @@
 
   <fingerprint pattern="^NET-DK[/ ](\d+\.\d+)$">
     <description>Web server found on ARRIS cable modems</description>
-    <example>NET-DK/1.0</example>
-    <example>NET-DK 1.1</example>
+    <example service.version="1.0">NET-DK/1.0</example>
+    <example service.version="1.1">NET-DK 1.1</example>
     <param pos="0" name="service.vendor" value="ARRIS"/>
     <param pos="0" name="service.product" value="Net-DK Web Server"/>
     <param pos="1" name="service.version"/>
@@ -3016,8 +3089,8 @@
 
   <fingerprint pattern="^GFE/((?:\d+\.)*\d+)$">
     <description>Google Front End for apps running on Google services.</description>
-    <example>GFE/1.3</example>
-    <example>GFE/1</example>
+    <example service.version="1.3">GFE/1.3</example>
+    <example service.version="1">GFE/1</example>
     <param pos="0" name="service.vendor" value="Google"/>
     <param pos="0" name="service.family" value="Google Web Server"/>
     <param pos="0" name="service.product" value="Google Front End"/>
@@ -3306,9 +3379,9 @@
 
   <fingerprint pattern="(?i)^Linux/(\S+) UPnP/[\d\.]+ miniupnpd/([\d\.]+)$">
     <description>Linux MiniUPnPd UPnP Server</description>
-    <example service.version="1.0">Linux/Cross_compiled UPnP/1.0 miniupnpd/1.0</example>
-    <example>Linux/2.6.29.6-217.2.3.fc11.i686.PAE UPnP/1.0 miniupnpd/1.0</example>
-    <example>Linux/2.4.21 UPnP/1.0 miniupnpd/1.0</example>
+    <example service.version="1.0" os.version="Cross_compiled">Linux/Cross_compiled UPnP/1.0 miniupnpd/1.0</example>
+    <example service.version="1.0" os.version="2.6.29.6-217.2.3.fc11.i686.PAE">Linux/2.6.29.6-217.2.3.fc11.i686.PAE UPnP/1.0 miniupnpd/1.0</example>
+    <example service.version="1.0" os.version="2.4.21">Linux/2.4.21 UPnP/1.0 miniupnpd/1.0</example>
     <param pos="0" name="service.vendor" value="MiniUPnP Project"/>
     <param pos="0" name="service.product" value="MiniUPnPd"/>
     <param pos="2" name="service.version"/>
@@ -3326,11 +3399,32 @@
     <param pos="0" name="service.product" value="MiniUPnPd"/>
     <param pos="1" name="service.version"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:miniupnp_project:miniupnpd:{service.version}"/>
+    <param pos="0" name="os.vendor" value="Tomato"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Tomato"/>
+    <param pos="0" name="os.device" value="Router"/>
+  </fingerprint>
+
+  <fingerprint pattern="^UPnP/Tomato ([\d\.]+)?[\w\s\.-]{1,30} UPnP/[\d\.]+ MiniUPnPd/([\d\.]+)$">
+    <description>TomatoUSB UPnP Server</description>
+    <example os.version="1.28.9014" service.version="1.8">UPnP/Tomato 1.28.9014 MIPSR2-RAF-v1.3g K26 UPnP/1.1 MiniUPnPd/1.8</example>
+    <example os.version="1.28.0000" service.version="1.9">UPnP/Tomato 1.28.0000 MIPSR2-132 K26 USB VPN UPnP/1.1 MiniUPnPd/1.9</example>
+    <example service.version="2.0">UPnP/Tomato MIPSR2-140 K26 UPnP/1.1 MiniUPnPd/2.0</example>
+    <example service.version="2.0">UPnP/Tomato MIPSR2Toastman-RT K26 UPnP/1.1 MiniUPnPd/2.0</example>
+    <param pos="0" name="service.vendor" value="MiniUPnP Project"/>
+    <param pos="0" name="service.product" value="MiniUPnPd"/>
+    <param pos="2" name="service.version"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:miniupnp_project:miniupnpd:{service.version}"/>
+    <param pos="0" name="os.vendor" value="TomatoUSB"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="TomatoUSB"/>
+    <param pos="0" name="os.device" value="Router"/>
+    <param pos="1" name="os.version"/>
   </fingerprint>
 
   <fingerprint pattern="(?i)^(RT-\w+) UPnP/\S+ MiniUPnPd/([\d.]+)$">
     <description>Asus WAP UPnP Server</description>
-    <example service.version="1.2">RT-G32 UPnP/1.0 MiniUPnPd/1.2</example>
+    <example service.version="1.2" os.product="RT-G32">RT-G32 UPnP/1.0 MiniUPnPd/1.2</example>
     <param pos="0" name="service.vendor" value="MiniUPnP Project"/>
     <param pos="0" name="service.product" value="MiniUPnPd"/>
     <param pos="2" name="service.version"/>
@@ -3401,9 +3495,9 @@
 
   <fingerprint pattern="^[^/]+/(\S+) DLNADOC/\S+ UPnP/\S+ MiniDLNA/(\S+)$">
     <description>DLNADOC UPnP Server</description>
-    <example>Debian/4.0r8 DLNADOC/1.50 UPnP/1.0 MiniDLNA/1.0</example>
-    <example>FreeBSD/8.2-RELEASE-p4 DLNADOC/1.50 UPnP/1.0 MiniDLNA/1.0.24</example>
-    <example>Linux/2.6.36+ DLNADOC/1.50 UPnP/1.0 MiniDLNA/1.0</example>
+    <example service.version="1.0" os.version="4.0r8">Debian/4.0r8 DLNADOC/1.50 UPnP/1.0 MiniDLNA/1.0</example>
+    <example service.version="1.0.24" os.version="8.2-RELEASE-p4">FreeBSD/8.2-RELEASE-p4 DLNADOC/1.50 UPnP/1.0 MiniDLNA/1.0.24</example>
+    <example service.version="1.0" os.version="2.6.36+">Linux/2.6.36+ DLNADOC/1.50 UPnP/1.0 MiniDLNA/1.0</example>
     <param pos="0" name="service.product" value="MiniDLNA"/>
     <param pos="2" name="service.version"/>
     <param pos="0" name="os.vendor" value="Linux"/>
@@ -3437,10 +3531,10 @@
     <param pos="2" name="service.version"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:miniupnp_project:miniupnpd:{service.version}"/>
     <param pos="0" name="os.family" value="Linux"/>
-    <param pos="0" name="os.vendor" value="Red Hat"/>
-    <param pos="0" name="os.product" value="Fedora Core Linux"/>
+    <param pos="0" name="os.vendor" value="Fedora Project"/>
+    <param pos="0" name="os.product" value="Fedora Core"/>
     <param pos="1" name="os.version"/>
-    <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora_core:{os.version}"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:fedoraproject:fedora_core:{os.version}"/>
   </fingerprint>
 
   <fingerprint pattern="(?i)^Ubuntu\/([\d\.]+) UPnP/\S+ MiniUPnPd/(\S+)$">
@@ -3669,7 +3763,7 @@
 
   <fingerprint pattern="(?i)^Linux Mips (\S+) UPnP/\S+ MiniUPnPd/(\S+)$">
     <description>Linux MIPS UPnP Server</description>
-    <example>Linux Mips 2.4.20 UPnP/1.0 MiniUPnPd/1.2</example>
+    <example service.version="1.2" os.version="2.4.20">Linux Mips 2.4.20 UPnP/1.0 MiniUPnPd/1.2</example>
     <param pos="0" name="service.vendor" value="MiniUPnP Project"/>
     <param pos="0" name="service.product" value="MiniUPnPd"/>
     <param pos="2" name="service.version"/>
@@ -3695,8 +3789,8 @@
 
   <fingerprint pattern="^(\S{1,16}) \d+/Service Pack \d+, UPnP/[\d\.]+, TVersity Media Server$">
     <description>TVersity Media Server UPnP Server with Service Pack</description>
-    <example>5.2.3790 2/Service Pack 1, UPnP/1.0, TVersity Media Server</example>
-    <example>5.1.2600 2/Service Pack 3, UPnP/1.0, TVersity Media Server</example>
+    <example service.version="5.2.3790">5.2.3790 2/Service Pack 1, UPnP/1.0, TVersity Media Server</example>
+    <example service.version="5.1.2600">5.1.2600 2/Service Pack 3, UPnP/1.0, TVersity Media Server</example>
     <param pos="0" name="service.vendor" value="TVersity"/>
     <param pos="0" name="service.product" value="Media Server"/>
     <param pos="1" name="service.version"/>
@@ -3704,10 +3798,10 @@
 
   <fingerprint pattern="^(\S{1,16}) 2/, UPnP/\S+, TVersity Media Server$">
     <description>TVersity Media Server UPnP Server</description>
-    <example>6.2.8400 2/, UPnP/1.0, TVersity Media Server</example>
-    <example>6.2.9200 2/, UPnP/1.0, TVersity Media Server</example>
-    <example>6.0.6000 2/, UPnP/1.0, TVersity Media Server</example>
-    <example>6.1.7600 2/, UPnP/1.0, TVersity Media Server</example>
+    <example service.version="6.2.8400">6.2.8400 2/, UPnP/1.0, TVersity Media Server</example>
+    <example service.version="6.2.9200">6.2.9200 2/, UPnP/1.0, TVersity Media Server</example>
+    <example service.version="6.0.6000">6.0.6000 2/, UPnP/1.0, TVersity Media Server</example>
+    <example service.version="6.1.7600">6.1.7600 2/, UPnP/1.0, TVersity Media Server</example>
     <param pos="0" name="service.vendor" value="TVersity"/>
     <param pos="0" name="service.product" value="Media Server"/>
     <param pos="1" name="service.version"/>
@@ -3715,7 +3809,7 @@
 
   <fingerprint pattern="^LINUX/([\d\.]+) UPnP/[\d\.]+ BRCM400/([\d\.]+)$">
     <description>Belkin/Linksys BRCM400 Wireless Router UPnP Server</description>
-    <example>LINUX/2.4 UPnP/1.0 BRCM400/1.0</example>
+    <example service.version="1.0" os.version="2.4">LINUX/2.4 UPnP/1.0 BRCM400/1.0</example>
     <param pos="0" name="service.vendor" value="Linksys"/>
     <param pos="0" name="service.product" value="BRCM400"/>
     <param pos="2" name="service.version"/>
@@ -3727,8 +3821,8 @@
 
   <fingerprint pattern="^Linux-(\S+), UPnP/[\d\.]+, PMS/([\d\.]+)$">
     <description>PlayStation3 Media Server UPnP Server - linux</description>
-    <example>Linux-amd64-2.6.18-238.9.1.el5, UPnP/1.0, PMS/1.52.1</example>
-    <example>Linux-i386-2.6.33.2, UPnP/1.0, PMS/1.21.1</example>
+    <example service.version="1.52.1" os.version="amd64-2.6.18-238.9.1.el5">Linux-amd64-2.6.18-238.9.1.el5, UPnP/1.0, PMS/1.52.1</example>
+    <example service.version="1.21.1" os.version="i386-2.6.33.2">Linux-i386-2.6.33.2, UPnP/1.0, PMS/1.21.1</example>
     <param pos="0" name="service.vendor" value="Sony"/>
     <param pos="0" name="service.product" value="PMS"/>
     <param pos="2" name="service.version"/>
@@ -3740,8 +3834,8 @@
 
   <fingerprint pattern="^Windows_XP-(\S+), UPnP/[\d\.]+, PMS/([\d\.]+)$">
     <description>PlayStation3 Media Server UPnP Server - Windows XP</description>
-    <example>Windows_XP-amd64-5.2, UPnP/1.0, PMS/1.54.0</example>
-    <example>Windows_XP-x86-5.1, UPnP/1.0, PMS/1.20.400</example>
+    <example service.version="1.54.0" os.version="amd64-5.2">Windows_XP-amd64-5.2, UPnP/1.0, PMS/1.54.0</example>
+    <example service.version="1.20.400" os.version="x86-5.1">Windows_XP-x86-5.1, UPnP/1.0, PMS/1.20.400</example>
     <param pos="0" name="service.vendor" value="Sony"/>
     <param pos="0" name="service.product" value="PMS"/>
     <param pos="2" name="service.version"/>
@@ -3753,13 +3847,13 @@
 
   <fingerprint pattern="^Windows_7-x86-(\S+), UPnP/[\d\.]+, PMS/([\d\.]+)$">
     <description>PlayStation3 Media Server UPnP Server - Windows 7 x86</description>
-    <example service.version="1.20">Windows_7-x86-6.1, UPnP/1.0, PMS/1.20</example>
-    <example>Windows_7-x86-6.1, UPnP/1.0, PMS/1.22.0</example>
-    <example>Windows_7-x86-6.1, UPnP/1.0, PMS/1.20.412</example>
-    <example>Windows_7-x86-6.1, UPnP/1.0, PMS/1.71.0</example>
-    <example>Windows_7-x86-6.1, UPnP/1.0, PMS/1.20.409</example>
-    <example>Windows_7-x86-6.1, UPnP/1.0, PMS/1.72.0</example>
-    <example>Windows_7-x86-6.1, UPnP/1.0, PMS/1.10.51</example>
+    <example service.version="1.20" os.version="6.1">Windows_7-x86-6.1, UPnP/1.0, PMS/1.20</example>
+    <example service.version="1.22.0" os.version="6.1">Windows_7-x86-6.1, UPnP/1.0, PMS/1.22.0</example>
+    <example service.version="1.20.412" os.version="6.1">Windows_7-x86-6.1, UPnP/1.0, PMS/1.20.412</example>
+    <example service.version="1.71.0" os.version="6.1">Windows_7-x86-6.1, UPnP/1.0, PMS/1.71.0</example>
+    <example service.version="1.20.409" os.version="6.1">Windows_7-x86-6.1, UPnP/1.0, PMS/1.20.409</example>
+    <example service.version="1.72.0" os.version="6.1">Windows_7-x86-6.1, UPnP/1.0, PMS/1.72.0</example>
+    <example service.version="1.10.51" os.version="6.1">Windows_7-x86-6.1, UPnP/1.0, PMS/1.10.51</example>
     <param pos="0" name="service.vendor" value="Sony"/>
     <param pos="0" name="service.product" value="PMS"/>
     <param pos="2" name="service.version"/>
@@ -3790,7 +3884,7 @@
 
   <fingerprint pattern="^Mac_OS_X-x86_64-(\S+), UPnP/[\d\.]+, PMS/([\d\.]+)$">
     <description>PlayStation3 Media Server UPnP Server - macOS x86_64</description>
-    <example>Mac_OS_X-x86_64-10.5.8, UPnP/1.0, PMS/1.20</example>
+    <example service.version="1.20" os.version="10.5.8">Mac_OS_X-x86_64-10.5.8, UPnP/1.0, PMS/1.20</example>
     <param pos="0" name="service.vendor" value="Sony"/>
     <param pos="0" name="service.product" value="PMS"/>
     <param pos="2" name="service.version"/>
@@ -3855,8 +3949,8 @@
 
   <fingerprint pattern="Linux, STUNNEL/1.0, (DIR-8\d+\w*) Ver (\S+)$">
     <description>D-Link DIR-8XX Router</description>
-    <example hw.product="DIR-850L">Linux, STUNNEL/1.0, DIR-850L Ver 1.09</example>
-    <example os.version="2.00W">Linux, STUNNEL/1.0, DIR-820LW Ver 2.00W</example>
+    <example hw.product="DIR-850L" os.version="1.09">Linux, STUNNEL/1.0, DIR-850L Ver 1.09</example>
+    <example os.version="2.00W" hw.product="DIR-820LW">Linux, STUNNEL/1.0, DIR-820LW Ver 2.00W</example>
     <param pos="0" name="hw.vendor" value="D-Link"/>
     <param pos="1" name="hw.product"/>
     <param pos="0" name="hw.device" value="Router"/>
@@ -3867,9 +3961,9 @@
 
   <fingerprint pattern="Linux, WEBACCESS/1.0, (DIR-\d+\w*) Ver (\S+)$">
     <description>D-Link DIR-XXX Router - WEBACCESS variant</description>
-    <example hw.product="DIR-850L">Linux, WEBACCESS/1.0, DIR-850L Ver 1.09</example>
-    <example os.version="1.14WW">Linux, WEBACCESS/1.0, DIR-850L Ver 1.14WW</example>
-    <example os.version="1.04">Linux, WEBACCESS/1.0, DIR-645 Ver 1.04</example>
+    <example hw.product="DIR-850L" os.version="1.09">Linux, WEBACCESS/1.0, DIR-850L Ver 1.09</example>
+    <example os.version="1.14WW" hw.product="DIR-850L">Linux, WEBACCESS/1.0, DIR-850L Ver 1.14WW</example>
+    <example os.version="1.04" hw.product="DIR-645">Linux, WEBACCESS/1.0, DIR-645 Ver 1.04</example>
     <param pos="0" name="hw.vendor" value="D-Link"/>
     <param pos="1" name="hw.product"/>
     <param pos="0" name="hw.device" value="Router"/>
@@ -3922,15 +4016,15 @@
 
   <fingerprint pattern="^ipos/([\d\.]+) UPnP/[\d\.]+ (TL-\w+)/(\S+)$">
     <description>TP-Link WAP UPnP Server</description>
-    <example>ipos/7.0 UPnP/1.0 TL-WR841N/6.0/7.0</example>
-    <example>ipos/7.0 UPnP/1.0 TL-WR841N/8.0</example>
-    <example>ipos/7.0 UPnP/1.0 TL-WR740N/4.0</example>
-    <example>ipos/7.0 UPnP/1.0 TL-WR940N/1.0</example>
-    <example>ipos/7.0 UPnP/1.0 TL-WR741N/4.0</example>
-    <example>ipos/7.0 UPnP/1.0 TL-WR740N/1.0</example>
-    <example>ipos/7.0 UPnP/1.0 TL-WR741N/1.0/2.0</example>
-    <example>ipos/7.0 UPnP/1.0 TL-WR740N/1.0/2.0</example>
-    <example>ipos/7.0 UPnP/1.0 TL-WR941N/2.0</example>
+    <example service.product="TL-WR841N" service.version="6.0/7.0" os.version="7.0">ipos/7.0 UPnP/1.0 TL-WR841N/6.0/7.0</example>
+    <example service.product="TL-WR841N" service.version="8.0" os.version="7.0">ipos/7.0 UPnP/1.0 TL-WR841N/8.0</example>
+    <example service.product="TL-WR740N" service.version="4.0" os.version="7.0">ipos/7.0 UPnP/1.0 TL-WR740N/4.0</example>
+    <example service.product="TL-WR940N" service.version="1.0" os.version="7.0">ipos/7.0 UPnP/1.0 TL-WR940N/1.0</example>
+    <example service.product="TL-WR741N" service.version="4.0" os.version="7.0">ipos/7.0 UPnP/1.0 TL-WR741N/4.0</example>
+    <example service.product="TL-WR740N" service.version="1.0" os.version="7.0">ipos/7.0 UPnP/1.0 TL-WR740N/1.0</example>
+    <example service.product="TL-WR741N" service.version="1.0/2.0" os.version="7.0">ipos/7.0 UPnP/1.0 TL-WR741N/1.0/2.0</example>
+    <example service.product="TL-WR740N" service.version="1.0/2.0" os.version="7.0">ipos/7.0 UPnP/1.0 TL-WR740N/1.0/2.0</example>
+    <example service.product="TL-WR941N" service.version="2.0" os.version="7.0">ipos/7.0 UPnP/1.0 TL-WR941N/2.0</example>
     <param pos="0" name="service.vendor" value="TP-LINK"/>
     <param pos="2" name="service.product"/>
     <param pos="3" name="service.version"/>
@@ -3961,7 +4055,7 @@
 
   <fingerprint pattern="^Linux/(\S+\_eureka_1), UPnP/[\d\.]+, Portable SDK for UPnP devices/(\S+)$">
     <description>Siqura Video Encoder</description>
-    <example>Linux/2.6.37_eureka_1, UPnP/1.0, Portable SDK for UPnP devices/1.6.6</example>
+    <example os.version="2.6.37_eureka_1" service.version="1.6.6">Linux/2.6.37_eureka_1, UPnP/1.0, Portable SDK for UPnP devices/1.6.6</example>
     <param pos="0" name="hw.vendor" value="Siqura"/>
     <param pos="0" name="hw.device" value="Video Encoder"/>
     <param pos="0" name="os.vendor" value="Siqura"/>
@@ -3974,7 +4068,7 @@
 
   <fingerprint pattern="^Linux/(\S+\-Mozart-8G), UPnP/[\d\.]+, Portable SDK for UPnP devices/(\S+)$">
     <description>Steinsvik Orbit IP Camera (Truen TCAM Rebrand)</description>
-    <example>Linux/2.6.28.9-Mozart-8G, UPnP/1.0, Portable SDK for UPnP devices/1.6.6</example>
+    <example os.version="2.6.28.9-Mozart-8G" service.version="1.6.6">Linux/2.6.28.9-Mozart-8G, UPnP/1.0, Portable SDK for UPnP devices/1.6.6</example>
     <param pos="0" name="hw.vendor" value="Steinsvik"/>
     <param pos="0" name="hw.device" value="IP Camera"/>
     <param pos="0" name="hw.product" value="Orbit IP Camera"/>
@@ -3988,7 +4082,7 @@
 
   <fingerprint pattern="^Linux/(\S+\-ami), UPnP/[\d\.]+, Portable SDK for UPnP devices/(\S+)$">
     <description>AMI MegaRAC LOM UPnP</description>
-    <example>Linux/3.14.17-ami, UPnP/1.0, Portable SDK for UPnP devices/1.6.20</example>
+    <example os.version="3.14.17-ami" service.version="1.6.20">Linux/3.14.17-ami, UPnP/1.0, Portable SDK for UPnP devices/1.6.20</example>
     <param pos="0" name="hw.device" value="Lights Out Management"/>
     <param pos="0" name="hw.vendor" value="AMI"/>
     <param pos="0" name="hw.family" value="MegaRAC"/>
@@ -4004,7 +4098,7 @@
 
   <fingerprint pattern="^Linux/(\S+\-axis[^,]+), UPnP/[\d\.]+, Portable SDK for UPnP devices/(\S+)$">
     <description>Axis Network Camera</description>
-    <example>Linux/4.9.94-axis5, UPnP/1.0, Portable SDK for UPnP devices/1.6.22</example>
+    <example os.version="4.9.94-axis5" service.version="1.6.22">Linux/4.9.94-axis5, UPnP/1.0, Portable SDK for UPnP devices/1.6.22</example>
     <param pos="0" name="hw.vendor" value="AXIS"/>
     <param pos="0" name="hw.device" value="IP Camera"/>
     <param pos="0" name="os.vendor" value="AXIS"/>
@@ -4018,23 +4112,23 @@
 
   <fingerprint pattern="^Linux/(\S+), UPnP/[\d\.]+, Portable SDK for UPnP devices/(\S+)$">
     <description>Portable SDK for UPnP Server - Linux</description>
-    <example>Linux/2.4.20-46.7asp, UPnP/1.0, Portable SDK for UPnP devices/1.6.17</example>
-    <example>Linux/2.6.10-iop1-1, UPnP/1.0, Portable SDK for UPnP devices/1.4.1</example>
-    <example>Linux/2.6.12-5.1-brcmstb-dm800, UPnP/1.0, Portable SDK for UPnP devices/1.6.0</example>
-    <example>Linux/2.6.12.6-VENUS, UPnP/1.0, Portable SDK for UPnP devices/1.6.10</example>
-    <example>Linux/2.6.12.6-arm1-040, UPnP/1.0, Portable SDK for UPnP devices/1.6.5.2</example>
-    <example>Linux/2.6.13, UPnP/1.0, Portable SDK for UPnP devices/1.6.0</example>
-    <example>Linux/2.6.18_pro500-davinci_N03A_IPCAM_1.0-g5c649288-dirty, UPnP/1.0, Portable SDK for UPnP devices/1.6.6</example>
-    <example>Linux/2.6.28, UPnP/1.0, Portable SDK for UPnP devices/1.6.10</example>
-    <example>Linux/2.6.28-11-server, UPnP/1.0, Portable SDK for UPnP devices/1.6.6</example>
-    <example>Linux/2.6.28-17-generic, UPnP/1.0, Portable SDK for UPnP devices/1.6.6</example>
-    <example>Linux/2.6.28.1-xxxx-std-ipv4-32, UPnP/1.0, Portable SDK for UPnP devices/1.4.3</example>
-    <example>Linux/2.6.32-220.7.1.el6.x86_64, UPnP/1.0, Portable SDK for UPnP devices/1.6.14</example>
-    <example>Linux/2.6.32-24-generic, UPnP/1.0, Portable SDK for UPnP devices/1.6.6</example>
-    <example>Linux/2.6.32-279.1.1.el6.x86_64, UPnP/1.0, Portable SDK for UPnP devices/1.6.13</example>
-    <example>Linux/2.6.32-279.11.1.el6.x86_64, UPnP/1.0, Portable SDK for UPnP devices/1.6.14</example>
-    <example>Linux/2.6.32-279.14.1.el6.x86_64, UPnP/1.0, Portable SDK for UPnP devices/1.6.14</example>
-    <example>Linux/2.6.32-279.14.1.el6.x86_64, UPnP/1.0, Portable SDK for UPnP devices/1.6.15</example>
+    <example service.version="1.6.17" os.version="2.4.20-46.7asp">Linux/2.4.20-46.7asp, UPnP/1.0, Portable SDK for UPnP devices/1.6.17</example>
+    <example service.version="1.4.1" os.version="2.6.10-iop1-1">Linux/2.6.10-iop1-1, UPnP/1.0, Portable SDK for UPnP devices/1.4.1</example>
+    <example service.version="1.6.0" os.version="2.6.12-5.1-brcmstb-dm800">Linux/2.6.12-5.1-brcmstb-dm800, UPnP/1.0, Portable SDK for UPnP devices/1.6.0</example>
+    <example service.version="1.6.10" os.version="2.6.12.6-VENUS">Linux/2.6.12.6-VENUS, UPnP/1.0, Portable SDK for UPnP devices/1.6.10</example>
+    <example service.version="1.6.5.2" os.version="2.6.12.6-arm1-040">Linux/2.6.12.6-arm1-040, UPnP/1.0, Portable SDK for UPnP devices/1.6.5.2</example>
+    <example service.version="1.6.0" os.version="2.6.13">Linux/2.6.13, UPnP/1.0, Portable SDK for UPnP devices/1.6.0</example>
+    <example service.version="1.6.6" os.version="2.6.18_pro500-davinci_N03A_IPCAM_1.0-g5c649288-dirty">Linux/2.6.18_pro500-davinci_N03A_IPCAM_1.0-g5c649288-dirty, UPnP/1.0, Portable SDK for UPnP devices/1.6.6</example>
+    <example service.version="1.6.10" os.version="2.6.28">Linux/2.6.28, UPnP/1.0, Portable SDK for UPnP devices/1.6.10</example>
+    <example service.version="1.6.6" os.version="2.6.28-11-server">Linux/2.6.28-11-server, UPnP/1.0, Portable SDK for UPnP devices/1.6.6</example>
+    <example service.version="1.6.6" os.version="2.6.28-17-generic">Linux/2.6.28-17-generic, UPnP/1.0, Portable SDK for UPnP devices/1.6.6</example>
+    <example service.version="1.4.3" os.version="2.6.28.1-xxxx-std-ipv4-32">Linux/2.6.28.1-xxxx-std-ipv4-32, UPnP/1.0, Portable SDK for UPnP devices/1.4.3</example>
+    <example service.version="1.6.14" os.version="2.6.32-220.7.1.el6.x86_64">Linux/2.6.32-220.7.1.el6.x86_64, UPnP/1.0, Portable SDK for UPnP devices/1.6.14</example>
+    <example service.version="1.6.6" os.version="2.6.32-24-generic">Linux/2.6.32-24-generic, UPnP/1.0, Portable SDK for UPnP devices/1.6.6</example>
+    <example service.version="1.6.13" os.version="2.6.32-279.1.1.el6.x86_64">Linux/2.6.32-279.1.1.el6.x86_64, UPnP/1.0, Portable SDK for UPnP devices/1.6.13</example>
+    <example service.version="1.6.14" os.version="2.6.32-279.11.1.el6.x86_64">Linux/2.6.32-279.11.1.el6.x86_64, UPnP/1.0, Portable SDK for UPnP devices/1.6.14</example>
+    <example service.version="1.6.14" os.version="2.6.32-279.14.1.el6.x86_64">Linux/2.6.32-279.14.1.el6.x86_64, UPnP/1.0, Portable SDK for UPnP devices/1.6.14</example>
+    <example service.version="1.6.15" os.version="2.6.32-279.14.1.el6.x86_64">Linux/2.6.32-279.14.1.el6.x86_64, UPnP/1.0, Portable SDK for UPnP devices/1.6.15</example>
     <param pos="0" name="service.product" value="libupnp"/>
     <param pos="2" name="service.version"/>
     <param pos="0" name="os.vendor" value="Linux"/>
@@ -4045,8 +4139,8 @@
 
   <fingerprint pattern="^Linux/(\S+) UPnP/[\d\.]+ DLNADOC/[\d\.]+ Portable SDK for UPnP devices/(\S+)$">
     <description>DLNADOC Portable SDK for UPnP Server - Linux DNLADOC variant</description>
-    <example>Linux/3.0.8 UPnP/1.0 DLNADOC/1.50 Portable SDK for UPnP devices/1.6.6</example>
-    <example>Linux/2.6.23.17_stm23_0125dorade00 UPnP/1.0 DLNADOC/1.50 Portable SDK for UPnP devices/1.4.6-5</example>
+    <example service.version="1.6.6" os.version="3.0.8">Linux/3.0.8 UPnP/1.0 DLNADOC/1.50 Portable SDK for UPnP devices/1.6.6</example>
+    <example service.version="1.4.6-5" os.version="2.6.23.17_stm23_0125dorade00">Linux/2.6.23.17_stm23_0125dorade00 UPnP/1.0 DLNADOC/1.50 Portable SDK for UPnP devices/1.4.6-5</example>
     <param pos="0" name="service.product" value="libupnp"/>
     <param pos="2" name="service.version"/>
     <param pos="0" name="os.vendor" value="Linux"/>
@@ -4057,8 +4151,8 @@
 
   <fingerprint pattern="^Linux/(\S+), UPnP/[\d\.]+, Intel SDK for UPnP devices ?/(\S+)$">
     <description>Intel SDK for UPnP Server with verbose banner</description>
-    <example>Linux/2.6.10_dev-malta-mips2_fp_le, UPnP/1.0, Intel SDK for UPnP devices /1.2</example>
-    <example>Linux/2.4.18_mvl30-ixdp425, UPnP/1.0, Intel SDK for UPnP devices/1.3.1</example>
+    <example service.version="1.2" os.version="2.6.10_dev-malta-mips2_fp_le">Linux/2.6.10_dev-malta-mips2_fp_le, UPnP/1.0, Intel SDK for UPnP devices /1.2</example>
+    <example service.version="1.3.1" os.version="2.4.18_mvl30-ixdp425">Linux/2.4.18_mvl30-ixdp425, UPnP/1.0, Intel SDK for UPnP devices/1.3.1</example>
     <param pos="0" name="service.product" value="libupnp"/>
     <param pos="2" name="service.version"/>
     <param pos="0" name="os.vendor" value="Linux"/>
@@ -4069,7 +4163,7 @@
 
   <fingerprint pattern="^Linux, UPnP/[\d\.]+, Intel SDK for UPnP devices ?/(\S+)$">
     <description>Intel SDK for UPnP Server</description>
-    <example>Linux, UPnP/1.0, Intel SDK for UPnP devices /1.2</example>
+    <example service.version="1.2">Linux, UPnP/1.0, Intel SDK for UPnP devices /1.2</example>
     <param pos="0" name="service.product" value="libupnp"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
@@ -4140,10 +4234,10 @@
 
   <fingerprint pattern="^UPnP/\S+, DLNADOC/\S+, Platinum/(\S+)$">
     <description>Xbox Media Center UPnP Server</description>
-    <example>UPnP/1.0, DLNADOC/1.50, Platinum/0.5.1</example>
-    <example>UPnP/1.0, DLNADOC/1.50, Platinum/0.6.6.0</example>
-    <example>UPnP/1.0, DLNADOC/1.50, Platinum/0.5.4.0</example>
-    <example>UPnP/1.0, DLNADOC/1.50, Platinum/0.5.3.0</example>
+    <example service.version="0.5.1">UPnP/1.0, DLNADOC/1.50, Platinum/0.5.1</example>
+    <example service.version="0.6.6.0">UPnP/1.0, DLNADOC/1.50, Platinum/0.6.6.0</example>
+    <example service.version="0.5.4.0">UPnP/1.0, DLNADOC/1.50, Platinum/0.5.4.0</example>
+    <example service.version="0.5.3.0">UPnP/1.0, DLNADOC/1.50, Platinum/0.5.3.0</example>
     <param pos="0" name="service.vendor" value="Microsoft"/>
     <param pos="0" name="service.product" value="XBMC"/>
     <param pos="1" name="service.version"/>
@@ -4372,6 +4466,15 @@
     <param pos="0" name="service.cpe23" value="cpe:/a:tinyproxy_project:tinyproxy:{service.version}"/>
   </fingerprint>
 
+  <fingerprint pattern="^mitmproxy ([\d.]+)$">
+    <description>mitmproxy interactive HTTPS proxy - https://github.com/mitmproxy/mitmproxy</description>
+    <example service.version="7.0.4">mitmproxy 7.0.4</example>
+    <param pos="0" name="service.vendor" value="mitmproxy"/>
+    <param pos="0" name="service.product" value="mitmproxy"/>
+    <param pos="1" name="service.version"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:mitmproxy:mitmproxy:{service.version}"/>
+  </fingerprint>
+
   <fingerprint pattern="^Xfinity Broadband Router Server$">
     <description>Comcast Xfinity Broadband Router Server</description>
     <example>Xfinity Broadband Router Server</example>
@@ -4383,7 +4486,7 @@
   <fingerprint pattern="^IX Series IX21\d\d \(magellan-sec\) Software, Version ([^, ]+), (?:MAINTENANCE )?RELEASE SOFTWARE$">
     <description>NEC Univerge Router - enterprise class with VPN, UTM, etc</description>
     <example hw.version="10.2.20">IX Series IX2106 (magellan-sec) Software, Version 10.2.20, RELEASE SOFTWARE</example>
-    <example>IX Series IX2105 (magellan-sec) Software, Version 9.6.12A, MAINTENANCE RELEASE SOFTWARE</example>
+    <example hw.version="9.6.12A">IX Series IX2105 (magellan-sec) Software, Version 9.6.12A, MAINTENANCE RELEASE SOFTWARE</example>
     <param pos="0" name="hw.vendor" value="NEC"/>
     <param pos="0" name="hw.product" value="Univerge"/>
     <param pos="1" name="hw.version"/>
@@ -4402,8 +4505,8 @@
   <fingerprint pattern="^MoxaHttp/(\d\.\d)$">
     <description>Moxa devices - service used on multiple families of devices</description>
     <example service.version="2.3">MoxaHttp/2.3</example>
-    <example>MoxaHttp/2.2</example>
-    <example>MoxaHttp/1.0</example>
+    <example service.version="2.2">MoxaHttp/2.2</example>
+    <example service.version="1.0">MoxaHttp/1.0</example>
     <param pos="0" name="service.vendor" value="Moxa"/>
     <param pos="0" name="service.product" value="httpd"/>
     <param pos="1" name="service.version"/>
@@ -4525,6 +4628,16 @@
     <param pos="0" name="service.cpe23" value="cpe:/a:cherokee-project:cherokee:{service.version}"/>
   </fingerprint>
 
+  <fingerprint pattern="^WebServer \(SerenityOS\)$">
+    <description>SerenityOS Web Server - https://github.com/SerenityOS/serenity</description>
+    <example>WebServer (SerenityOS)</example>
+    <param pos="0" name="service.vendor" value="SerenityOS"/>
+    <param pos="0" name="service.product" value="WebServer"/>
+    <param pos="0" name="os.vendor" value="SerenityOS"/>
+    <param pos="0" name="os.product" value="Serenity"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:serenityos:serenity:-"/>
+  </fingerprint>
+
   <!-- This is a version of ACME mini_httpd where the value 'mini_httpd' has been
       replaced with a UUID in the Server header AND body of the response. It
       is likely vendor or product specific.
@@ -4571,7 +4684,7 @@
 
   <fingerprint pattern="UNMS (\d+\.\d+\.\d+)">
     <description>Ubiquiti UNMS</description>
-    <example>302 Found UNMS 1.2.7</example>
+    <example service.version="1.2.7">302 Found UNMS 1.2.7</example>
     <param pos="0" name="service.vendor" value="Ubiquiti"/>
     <param pos="0" name="service.product" value="UNMS"/>
     <param pos="1" name="service.version"/>
@@ -4615,4 +4728,31 @@
     <param pos="0" name="hw.device" value="Printer"/>
   </fingerprint>
 
+  <fingerprint pattern="^Eltex (TAU-\d+[A-Z]*(?:\.IP)?)$">
+    <description>Eltex TAU model VoIP gateway</description>
+    <example hw.product="TAU-72">Eltex TAU-72</example>
+    <example hw.product="TAU-1.IP">Eltex TAU-1.IP</example>
+    <param pos="0" name="os.vendor" value="Eltex"/>
+    <param pos="0" name="os.product" value="{hw.product} Firmware"/>
+    <param pos="0" name="os.device" value="VoIP Gateway"/>
+    <param pos="0" name="hw.vendor" value="Eltex"/>
+    <param pos="1" name="hw.product"/>
+    <param pos="0" name="hw.device" value="VoIP Gateway"/>
+  </fingerprint>
+
+  <fingerprint pattern="^(SMG-?\d+[A-Z]?)$">
+    <description>Eltex SMG model VoIP gateway</description>
+    <example hw.product="SMG2">SMG2</example>
+    <example hw.product="SMG1016M">SMG1016M</example>
+    <example hw.product="SMG-1016M">SMG-1016M</example>
+    <example hw.product="SMG3016">SMG3016</example>
+    <param pos="0" name="os.vendor" value="Eltex"/>
+    <param pos="0" name="os.product" value="{hw.product} Firmware"/>
+    <param pos="0" name="os.device" value="VoIP Gateway"/>
+    <param pos="0" name="hw.vendor" value="Eltex"/>
+    <param pos="1" name="hw.product"/>
+    <param pos="0" name="hw.device" value="VoIP Gateway"/>
+  </fingerprint>
+
+
 </fingerprints>