recog 2.3.5 → 2.3.10

data/xml/pop_banners.xml

@@ -1,9 +1,10 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version='1.0' encoding='UTF-8'?>
 <fingerprints matches="pop3.banner" protocol="pop3" database_type="service" preference="0.90">
   <!--
   POP3 greeting messages (part of the banner after the status indicator +OK or -ERR) are
   matched against these patterns to fingerprint POP3 servers.
   -->
+
   <fingerprint pattern="^([^ ]+) +Cyrus POP3 v(\d+\.\d+.*)-OS X(?: Server)? ([\d\.]+).* server ready">
     <description>OSX Cyrus POP</description>
     <example host.domain="8.8.8.8" service.version="2.3.8" os.version="10.5">8.8.8.8 Cyrus POP3 v2.3.8-OS X Server 10.5: 9A562 server ready &lt;1999107648.1324502155@8.8.8.8&gt;</example>
@@ -18,6 +19,7 @@
     <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os_x:{os.version}"/>
     <param pos="1" name="host.domain"/>
   </fingerprint>
+
   <fingerprint pattern="^([^ ]+) +Cyrus POP3 v([\d\.]+)">
     <description>CMU Cyrus POP</description>
     <example host.domain="foo" service.version="2.3">foo Cyrus POP3 v2.3</example>
@@ -28,6 +30,7 @@
     <param pos="2" name="service.version"/>
     <param pos="1" name="host.domain"/>
   </fingerprint>
+
   <fingerprint pattern="^Lotus Notes POP3 server version X[^ ]+ ready on .*$">
     <description>IBM Lotus Notes/Domino</description>
     <example>Lotus Notes POP3 server version X2.0 ready on foo/bar.</example>
@@ -36,6 +39,7 @@
     <param pos="0" name="service.product" value="Lotus Domino"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Lotus Notes POP3 server version Release ([^ ]+) ready on .*$">
     <description>IBM Lotus Notes/Domino - Release variant</description>
     <example service.version="8.5.1FP5">Lotus Notes POP3 server version Release 8.5.1FP5 ready on foo/US.</example>
@@ -45,6 +49,7 @@
     <param pos="1" name="service.version"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:ibm:lotus_domino:{service.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^Qpopper \(version (\d+\.\d+\.\d+), modified by Sphera Technologies\) at (.+) starting\..*$">
     <description>Qpopper with Sphera mods</description>
     <example>Qpopper (version 4.0.3, modified by Sphera Technologies) at domain starting.  &lt;xxx@domain&gt;</example>
@@ -54,6 +59,7 @@
     <param pos="1" name="service.version"/>
     <param pos="2" name="host.domain"/>
   </fingerprint>
+
   <fingerprint pattern="^Qpopper \(version (\d+\.\d+\.\d+)-mysql-(.+)\) at (.+) starting\..*$">
     <description>Qpopper with MySQL auth module</description>
     <example>Qpopper (version 4.0.3-mysql-0.13) at domain starting.  &lt;xxx@domain&gt;</example>
@@ -66,6 +72,7 @@
     <param pos="2" name="service.component.version"/>
     <param pos="3" name="host.domain"/>
   </fingerprint>
+
   <fingerprint pattern="(?i)^Qpop(?:per)? \(version ([\d\.]+)\) at (.+)(?: starting\.)?.*$">
     <description>Qpopper missing version info</description>
     <example>Qpopper (version 4.0.16) at foo.example.com</example>
@@ -77,6 +84,7 @@
     <param pos="1" name="service.version"/>
     <param pos="2" name="host.domain"/>
   </fingerprint>
+
   <fingerprint pattern="^QPOP \(version (.*)\) at (.+) starting\..*$">
     <description>Qpopper with missing version info</description>
     <example>QPOP (version ?) at domain starting.  &lt;xxx@domain&gt;</example>
@@ -86,6 +94,7 @@
     <param pos="1" name="qpopper.version"/>
     <param pos="2" name="host.domain"/>
   </fingerprint>
+
   <fingerprint pattern="^Microsoft Exchange Server 2003 POP3 server version (\d+\.\d+\.\d+\.\d+) (.+) ready.$">
     <description>Microsoft Exchange Server 2003</description>
     <example>Microsoft Exchange Server 2003 POP3 server version 6.5.6944.0 (host) ready.</example>
@@ -100,6 +109,7 @@
     <param pos="0" name="os.product" value="Windows"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Microsoft Exchange 2000 POP3 server version (\d+\.\d+\.\d+\.\d+) (.+) ready.$">
     <description>Microsoft Exchange Server 2000</description>
     <example>Microsoft Exchange 2000 POP3 server version 6.0.6603.0 (host) ready.</example>
@@ -114,6 +124,7 @@
     <param pos="0" name="os.product" value="Windows"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Microsoft Exchange POP3 server version (\d+\.\d+\.\d+\.\d+) ready$">
     <description>Microsoft Exchange Server</description>
     <example>Microsoft Exchange POP3 server version 5.5.2654.50 ready</example>
@@ -127,6 +138,7 @@
     <param pos="0" name="os.product" value="Windows"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Microsoft Windows POP3 Service Version 1.0 &lt;.+@(.+)&gt; ready.$">
     <description>Microsoft POP3 Services on Windows 2003</description>
     <example>Microsoft Windows POP3 Service Version 1.0 &lt;xxx@host&gt; ready.</example>
@@ -139,6 +151,7 @@
     <param pos="0" name="os.product" value="Windows Server 2003"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows_server_2003:-"/>
   </fingerprint>
+
   <fingerprint pattern="^Microsoft Exchange Server 2007 POP3 service ready\.?$">
     <description>Microsoft Exchange Server 2007</description>
     <example>Microsoft Exchange Server 2007 POP3 service ready</example>
@@ -151,6 +164,7 @@
     <param pos="0" name="os.product" value="Windows"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
   </fingerprint>
+
   <fingerprint pattern="^The? Microsoft Exchange POP3 service is ready\.?$">
     <description>Microsoft Exchange Server, generic</description>
     <example>The Microsoft Exchange POP3 service is ready.</example>
@@ -163,12 +177,14 @@
     <param pos="0" name="os.product" value="Windows"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
   </fingerprint>
+
   <fingerprint pattern="^[dD]ovecot (?:DA )?ready\.(?: &lt;.+@(.+)&gt;)?$">
     <description>Dovecot Secure POP Server</description>
     <param pos="0" name="service.family" value="Dovecot"/>
     <param pos="0" name="service.product" value="Dovecot"/>
     <param pos="1" name="host.name"/>
   </fingerprint>
+
   <fingerprint pattern="^(\S+) Zimbra POP3 server ready\.?$">
     <description>VMware Zimbra POP</description>
     <example host.name="foo.bar">foo.bar Zimbra POP3 server ready</example>
@@ -177,6 +193,7 @@
     <param pos="0" name="service.cpe23" value="cpe:/a:vmware:zimbra_desktop:-"/>
     <param pos="1" name="host.name"/>
   </fingerprint>
+
   <fingerprint pattern="^(\S+) Zimbra (\S+) POP3 server ready\.?$">
     <description>VMware Zimbra POP with version</description>
     <example host.name="foo.bar">foo.bar Zimbra 7.0.0_GA_3079 POP3 server ready</example>
@@ -186,12 +203,14 @@
     <param pos="0" name="service.cpe23" value="cpe:/a:vmware:zimbra_desktop:{service.version}"/>
     <param pos="1" name="host.name"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:S?POP3? server ready |Hello there.? )?&lt;.*@([^&gt;]+)&gt;$">
     <description>Generic masked POP3 server</description>
     <example>POP3 server ready &lt;58c29ae4-7316-429e-8109-060444ab1a28@foo.example.com&gt;</example>
     <example>&lt;84427.1298535083@foo.example.com&gt;</example>
     <param pos="1" name="host.name"/>
   </fingerprint>
+
   <fingerprint pattern="^ApplePasswordServer ([\d\.]+) password">
     <description>Apple Open Directory</description>
     <example>ApplePasswordServer 10.6.0.0 password server at 10.2.90.228 ready.</example>
@@ -205,6 +224,7 @@
     <param pos="0" name="os.certainty" value="0.5"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:apple:mac_os_x:{os.version}"/>
   </fingerprint>
+
   <fingerprint pattern="^TCPIP POP server V\d\.\d\S-\S{3}, OpenVMS V(\d\.\d-\d)(?:\s+\S+)?\s+at\s+(\S+), .*$">
     <description>TCP/IP Services for OpenVMS POP server</description>
     <example os.version="7.3-2" host.name="example.com">TCPIP POP server V5.4J-15A, OpenVMS V7.3-2 Alpha at example.com, up since 2015-02-12 08:44:53 20400434.2</example>
@@ -218,6 +238,7 @@
     <param pos="0" name="os.cpe23" value="cpe:/o:hp:openvms:{os.version}"/>
     <param pos="2" name="host.name"/>
   </fingerprint>
+
   <fingerprint pattern="^Hello there\.$">
     <description>Courier MTA POP</description>
     <example>Hello there.</example>
@@ -225,6 +246,7 @@
     <param pos="0" name="service.family" value="Courier MTA"/>
     <param pos="0" name="service.product" value="Courier POP"/>
   </fingerprint>
+
   <fingerprint pattern="^CMailServer ([\d\.]+) POP3 Service Ready$">
     <description>CMailServer</description>
     <example service.version="5.0.0">CMailServer 5.0.0 POP3 Service Ready</example>
@@ -234,6 +256,7 @@
     <param pos="0" name="os.vendor" value="Microsoft"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^POP3 Bigfoot v(\d\.\d) server ready$">
     <description>POP3 Bigfoot server</description>
     <example service.version="1.0">POP3 Bigfoot v1.0 server ready</example>
@@ -242,6 +265,7 @@
     <param pos="0" name="service.product" value="Bigfoot Email Tools"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^CCProxy ([\d.]+) POP3 Service Ready$">
     <description>CCProxy POP3 server</description>
     <example service.version="8.0">CCProxy 8.0 POP3 Service Ready</example>
@@ -252,6 +276,7 @@
     <param pos="0" name="service.product" value="CCProxy"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^POP3 on WinWebMail \[([\d.]+)\] ready\.$">
     <description>WinWebmail POP3</description>
     <example service.version="1.1.1.1">POP3 on WinWebMail [1.1.1.1] ready.</example>
@@ -263,6 +288,7 @@
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <fingerprint pattern="^BlackJumboDog \(Version ([\d\.]+)\) ready$">
     <description>BlackJumboDog</description>
     <example service.version="5.7.5.0">BlackJumboDog (Version 5.7.5.0) ready</example>
@@ -274,6 +300,7 @@
     <param pos="0" name="os.cpe23" value="cpe:/o:microsoft:windows:-"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
+
   <!--
 ; Mandrake 8.1 - uses UW IMAP
 ; +OK POP3 mandrake81-f540k v2000.70mdk server ready
@@ -283,66 +310,38 @@
 // +OK POP3 [158.122.12.70] v2003.83mdk server ready
 // +OK POP3 [161.58.53.189] 2006b.94 server ready
 // +OK POP3 [192.168.0.250] v2000.70rh server ready
-
 ; Lotus Domino - NOTE: POP versions do not map to Domino version
 // +OK Lotus Notes POP3 server version X2.0 ready <0015521D.86257321.0000081C.00000008@Atlas/AgileTek> on Atlas/AgileTek.
 ( call ?j_popPatterns add
 "^\\+OK Lotus Notes POP3 server version ([^ ]*) ready on ([^\\.]*)\\.$" )
 ( call ?j_popNames add "Lotus-Domino" )
-
 // +OK alquilerpc.com.mx POP3 Server (Version 1.020h) ready.
-
 // Ipswitch IMail
 // +OK X1 NT-POP3 Server geneseenet06 (IMail 8.22 45450-1)
-
 // +OK X1 POP3 Mail Server
-
 // +OK server POP3 server (DeskNow POP3 Server 1.0) ready
-
 // +OK <1185161310.3352@goto15028.com> [XMail 1.24 POP3 Server] service ready; Mon, 23 Jul 2007 11:28:30 +0800
-
 // +OK IdeaPop3Server v0.50 ready.
-
 // +OK qxztmail POP3 server (STD Ymailserver v1.8 POP3) ready
-
 // +OK blue.forest-green.lan POP3 server (JAMES POP3 Server 2.2.0) ready
-
 // +OK xxx CMailServer 5.2 POP3 Service Ready
-
 // +OK iac3 Solstice (tm) Internet Mail Server (tm) POP3 2.0 at Mon, 23 Jul 2007 20:08:02 -0500 (CDT)
-
 // +OK Gordano Messaging Suite POP3 server ready
 // +OK Gordano Messaging Suite POP3 server ready <13501095613509@hollandcanadaline.com>
-
 // +OK unitechna.lt Merak 8.9.1 POP3 Sun, 22 Jul 2007 23:16:25 +0300 <20070722231625@unitechna.lt>
-
-
 // +OK Cubic Circle's v1.31 1998/05/13 POP3 ready <0c9300004104a246@www.dvdld.co.za>
-
 // +OK Welcome to MailEnable POP3 Server
-
 // +OK GroupWise POP3 server ready
-
 // +OK POP3 AnalogX Proxy 4.14 (Release) ready.
-
 // +OK lojack.com.ar POP MDaemon 9.6.0 ready <MDAEMON-F200707232110.AA1001241MD4604@lojack.com.ar>
-
 // +OK DBMAIL pop3 server ready to rock <4393e6301f984e87ad7cdc766595c78f@mx>
-
 // +OK POP3 Welcome to vm-pop3d 1.1.6 <83532.1185400462@romeo.hostlab.nl>
-
 // +OK Solid POP3 server ready
-
 // +OK ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.8.9)
-
 // +OK POP3 titan [cppop 20.0] at [207.150.171.34]
-
 // +OK ModusMail POP3 Server-NOTF 4.2.425.4 Ready <42760712.1185328354.283@gbso.net>
-
 // +OK DPOP Version number supressed.
-
 // +OK XPOP3 0.0.1 server ready
-
 -ERR (Proxy) connect error:socket error:No route to host
 -ERR No permission
 -ERR sorry, POP server too busy right now.  Try again later.
@@ -494,6 +493,6 @@
 // apparently this is a P3Scan Proxy bug
 // http://lists.freebsd.org/pipermail/freebsd-ports/2004-May/012400.html
 Oops, that would loop!
-
 -->
-</fingerprints>
+
+</fingerprints>

data/xml/rsh_resp.xml

@@ -1,14 +1,16 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version='1.0' encoding='UTF-8'?>
 <fingerprints protocol="rsh" database_type="service">
   <!--
   Rservices responses to requests are matched against these patterns to fingerprint the OSes of servers.
   -->
+
   <fingerprint pattern="^.Permission denied: Error 0$">
     <description>Digital Unix rlogind</description>
     <example>xPermission denied: Error 0</example>
     <param pos="0" name="os.vendor" value="HP"/>
     <param pos="0" name="os.family" value="Digital Unix"/>
   </fingerprint>
+
   <fingerprint pattern="^.Winsock RSHD/NT: Protocol negotiation error\..+$|^.in\.rlogind: Permission denied\..+$" flags="REG_DOT_NEWLINE">
     <description>Windows rlogind</description>
     <example>xWinsock RSHD/NT: Protocol negotiation error.
@@ -18,6 +20,7 @@
     <param pos="0" name="os.vendor" value="Microsoft"/>
     <param pos="0" name="os.family" value="Windows"/>
   </fingerprint>
+
   <fingerprint pattern="^.permission denied\..+$" flags="REG_DOT_NEWLINE">
     <description>Solaris rlogind</description>
     <example>xpermission denied.
@@ -27,6 +30,7 @@
     <param pos="0" name="os.product" value="Solaris"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:sun:solaris:-"/>
   </fingerprint>
+
   <fingerprint pattern="^.rlogind: Acc.s refus.\..+$" flags="REG_DOT_NEWLINE">
     <description>AIX rlogind</description>
     <example>xrlogind: Accxs refusx.
@@ -36,6 +40,7 @@
     <param pos="0" name="os.product" value="AIX"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:-"/>
   </fingerprint>
+
   <fingerprint pattern="^.rlogind: Host name for your address \([\d.]+\) unknown\..*$" flags="REG_DOT_NEWLINE">
     <description>A/UX rlogind</description>
     <example>xrlogind: Host name for your address (127.0.0.1) unknown.
@@ -43,6 +48,7 @@
     <param pos="0" name="os.vendor" value="Apple"/>
     <param pos="0" name="os.family" value="A/UX"/>
   </fingerprint>
+
   <fingerprint pattern="^.rexecd: Login incorrect\..*$" flags="REG_DOT_NEWLINE">
     <description>HP-UX rexecd</description>
     <example>xrexecd: Login incorrect.
@@ -52,6 +58,7 @@
     <param pos="0" name="os.product" value="HP-UX"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:-"/>
   </fingerprint>
+
   <fingerprint pattern="^.rexecd: [-\d]+.*$" flags="REG_DOT_NEWLINE">
     <description>AIX rexecd</description>
     <example>xrexecd: 0-1 The login is not correct.
@@ -61,6 +68,7 @@
     <param pos="0" name="os.product" value="AIX"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:ibm:aix:-"/>
   </fingerprint>
+
   <fingerprint pattern="^.remshd: (?:getservbyname.+|Kerberos Authentication not enabled\..+|Error! Kerberos authentication failed)$" flags="REG_DOT_NEWLINE">
     <description>HP-UX rshd</description>
     <example>xremshd: getservbyname
@@ -73,4 +81,5 @@
     <param pos="0" name="os.product" value="HP-UX"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:hp:hp-ux:-"/>
   </fingerprint>
-</fingerprints>
+
+</fingerprints>

data/xml/rtsp_servers.xml

@@ -0,0 +1,96 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<fingerprints matches="rtsp_header.server" protocol="rtsp" database_type="service" preference="0.85">
+  <fingerprint pattern="^Flussonic \(http:\/\/www.flussonic.com\/\) ([\d\.]+)$">
+    <description>Flussonic Media Server</description>
+    <example service.version="19.04">Flussonic (http://www.flussonic.com/) 19.04</example>
+    <example service.version="20.01">Flussonic (http://www.flussonic.com/) 20.01</example>
+    <param pos="0" name="service.vendor" value="Flussonic"/>
+    <param pos="0" name="service.product" value="Flussonic Media Server"/>
+    <param pos="1" name="service.version"/>
+  </fingerprint>
+
+  <fingerprint pattern="^Hipcam RealServer\/V([\d\.]+)$">
+    <description>Hipcam IP camera running the RealServer RTSP server.</description>
+    <example service.version="1.0">Hipcam RealServer/V1.0</example>
+    <param pos="0" name="service.vendor" value="RealNetworks"/>
+    <param pos="0" name="service.product" value="RealServer"/>
+    <param pos="1" name="service.version"/>
+    <param pos="0" name="hw.vendor" value="Hipcam"/>
+    <param pos="0" name="hw.device" value="IP Camera"/>
+  </fingerprint>
+
+  <fingerprint pattern="^Dahua Rtsp Server$">
+    <description>Dahua IP Camera</description>
+    <example>Dahua Rtsp Server</example>
+    <param pos="0" name="service.vendor" value="Dahua"/>
+    <param pos="0" name="hw.vendor" value="Dahua"/>
+    <param pos="0" name="hw.device" value="IP Camera"/>
+  </fingerprint>
+
+  <fingerprint pattern="^GStreamer RTSP server$">
+    <description>GStreamer RTSP Server (https://github.com/GStreamer/gst-rtsp-server)</description>
+    <example>GStreamer RTSP server</example>
+    <param pos="0" name="service.vendor" value="GStreamer"/>
+    <param pos="0" name="service.product" value="GStreamer RTSP Server"/>
+  </fingerprint>
+
+  <fingerprint pattern="^WMServer\/([\d\.]+)$">
+    <description>Windows Media Server</description>
+    <example service.version="9.1.1.3862">WMServer/9.1.1.3862</example>
+    <example service.version="9.5.6001.22609">WMServer/9.5.6001.22609</example>
+    <param pos="0" name="service.vendor" value="Microsoft"/>
+    <param pos="0" name="service.product" value="Windows Media Server"/>
+    <param pos="0" name="service.family" value="Windows Media Server"/>
+    <param pos="1" name="service.version"/>
+    <param pos="0" name="os.vendor" value="Microsoft"/>
+    <param pos="0" name="os.family" value="Windows"/>
+  </fingerprint>
+
+  <fingerprint pattern="^Wowza (Streaming Engine|Media Server) ([\d\.]+) build(\d*)$">
+    <description>Wowza Media Systems Streaming Video Services</description>
+    <example service.version="4.7.7" service.version.version="20181108145350" service.product="Streaming Engine">Wowza Streaming Engine 4.7.7 build20181108145350</example>
+    <example service.version="3.6.4" service.version.version="9641" service.product="Media Server">Wowza Media Server 3.6.4 build9641</example>
+    <param pos="0" name="service.vendor" value="Wowza Media Systems"/>
+    <param pos="1" name="service.product"/>
+    <param pos="2" name="service.version"/>
+    <param pos="3" name="service.version.version"/>
+  </fingerprint>
+
+  <fingerprint pattern="^HiIpcam\/V\d+R\d+ VodServer\/[\d\.]+$">
+    <description>Foscam IP Camera</description>
+    <example>HiIpcam/V100R003 VodServer/1.0.0</example>
+    <param pos="0" name="hw.vendor" value="Foscam"/>
+    <param pos="0" name="hw.device" value="IP Camera"/>
+  </fingerprint>
+
+  <fingerprint pattern="^Indigo\-Security\/[\d\.]+$">
+    <description>Indigo Security IP Camera</description>
+    <example>Indigo-Security/1.0</example>
+    <param pos="0" name="hw.vendor" value="Indigo Security"/>
+    <param pos="0" name="hw.device" value="IP Camera"/>
+  </fingerprint>
+
+  <fingerprint pattern="^Cisco MediaSense Media Server$">
+    <description>Cisco MediaSense Media Server (RTSP)</description>
+    <example>Cisco MediaSense Media Server</example>
+    <param pos="0" name="service.vendor" value="Cisco"/>
+    <param pos="0" name="service.product" value="MediaSense"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:cisco:mediasense:-"/>
+    <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.device" value="SIP Gateway"/>
+    <param pos="0" name="hw.product" value="MediaSense"/>
+  </fingerprint>
+
+  <fingerprint pattern="^AvigilonOnvifNvt/(\d+\.\S+)">
+    <description>Avigilon IP Camera</description>
+    <example os.version="2.6.0.130">AvigilonOnvifNvt/2.6.0.130</example>
+    <param pos="0" name="hw.vendor" value="Avigilon"/>
+    <param pos="0" name="hw.device" value="IP Camera"/>
+    <param pos="0" name="os.vendor" value="Avigilon"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Linux"/>
+    <param pos="1" name="os.version"/>
+  </fingerprint>
+
+</fingerprints>

data/xml/sip_banners.xml

@@ -1,28 +1,50 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version='1.0' encoding='UTF-8'?>
 <fingerprints matches="sip_header.server" protocol="sip" database_type="service">
   <!--
   SIP Server header values are matched against these patterns to fingerprint SIP devices.
   -->
-  <fingerprint pattern="^Cisco-SIPGateway/IOS-(\d+)\.x$">
-    <description>Cisco IOS with SIPGateway with only major version</description>
+
+  <!-- Cisco/Tandberg Products -->
+
+  <fingerprint pattern="^Cisco-SIPGateway/IOS-(\S+)\.x$">
+    <description>Cisco IOS SIP Gateway w/ Vague Version</description>
     <example os.version="12">Cisco-SIPGateway/IOS-12.x</example>
+    <param pos="0" name="service.vendor" value="Cisco"/>
+    <param pos="0" name="service.family" value="IOS"/>
+    <param pos="0" name="service.product" value="IOS"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:-"/>
     <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="os.family" value="IOS"/>
     <param pos="0" name="os.product" value="IOS"/>
+    <param pos="0" name="os.certainty" value="0.8"/>
     <param pos="1" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:{os.version}"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.device" value="Router"/>
   </fingerprint>
-  <fingerprint pattern="^Cisco-SIPGateway/IOS-([\d\.a-zA-Z]+)$">
-    <description>Cisco IOS with SIPGateway</description>
+
+  <fingerprint pattern="^Cisco-SIPGateway/IOS-(\S+)$">
+    <description>Cisco IOS SIP Gateway w/ Full Version</description>
+    <example os.version="15.2.4.M3">Cisco-SIPGateway/IOS-15.2.4.M3</example>
     <example os.version="15.2.2.T1">Cisco-SIPGateway/IOS-15.2.2.T1</example>
     <example os.version="15.2.3.T">Cisco-SIPGateway/IOS-15.2.3.T</example>
     <example os.version="15.4.3.S5">Cisco-SIPGateway/IOS-15.4.3.S5</example>
     <example os.version="15.6.3.M0a">Cisco-SIPGateway/IOS-15.6.3.M0a</example>
     <example os.version="16.3.6">Cisco-SIPGateway/IOS-16.3.6</example>
+    <param pos="0" name="service.vendor" value="Cisco"/>
+    <param pos="0" name="service.family" value="IOS"/>
+    <param pos="0" name="service.product" value="IOS"/>
+    <param pos="0" name="service.cpe23" value="cpe:/a:cisco:ios:-"/>
     <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="os.family" value="IOS"/>
     <param pos="0" name="os.product" value="IOS"/>
+    <param pos="0" name="os.certainty" value="1.0"/>
     <param pos="1" name="os.version"/>
     <param pos="0" name="os.cpe23" value="cpe:/o:cisco:ios:{os.version}"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.device" value="Router"/>
   </fingerprint>
+
   <fingerprint pattern="^Cisco-CP-?(\d+G?)(?:-\S+)?/([\d\.]+)">
     <description>Cisco CP VoIP Phone</description>
     <example hw.model="7960G" hw.version="8.0">Cisco-CP7960G/8.0</example>
@@ -37,6 +59,7 @@
     <param pos="1" name="hw.model"/>
     <param pos="2" name="hw.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?:Cisco|Linksys)/(SPA\d+[DG]?\d?)-([\d\.a-zA-Z]+)">
     <description>Cisco/Linksys SPA VoIP Phone</description>
     <example hw.model="SPA112" hw.version="1.4.1SR1">Cisco/SPA112-1.4.1SR1(002)d-hisec</example>
@@ -54,6 +77,7 @@
     <param pos="1" name="hw.model"/>
     <param pos="2" name="hw.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?:Cisco|Linksys)(?: |/)(PAP2T?)(?:-|/)(\S+)$">
     <description>Cisco/Linksys VoIP / Internet Phone adapter</description>
     <example hw.version="3.1.22(LS)" hw.model="PAP2">PhoneSystems.net aabbccddeeff Linksys/PAP2-3.1.22(LS)</example>
@@ -69,6 +93,7 @@
     <param pos="1" name="hw.model"/>
     <param pos="2" name="hw.version"/>
   </fingerprint>
+
   <fingerprint pattern="^Cisco/(SRP\d+)-([\d\.]+)">
     <description>Cisco Services Ready Platforms (SRP) Router</description>
     <example hw.model="SRP541" hw.version="1.2.6">Cisco/SRP541-1.2.6(003)</example>
@@ -81,6 +106,7 @@
     <param pos="1" name="hw.model"/>
     <param pos="2" name="hw.version"/>
   </fingerprint>
+
   <fingerprint pattern="(?:Cisco|Linksys)/(WRP\d+)-(\S+)$">
     <description>Cisco/Linksys WRP Wireless Router</description>
     <example hw.version="2.00.26" hw.model="WRP400">aabbccddeeff_FinalStage_Linksys/WRP400-2.00.26</example>
@@ -94,6 +120,43 @@
     <param pos="1" name="hw.model"/>
     <param pos="2" name="hw.version"/>
   </fingerprint>
+
+  <fingerprint pattern="^TANDBERG/(\d+) \((.*)\) Cisco-(\S+)$">
+    <description>Cisco/Tandberg TelePresence w/Cisco Model Name</description>
+    <example os.version="TC7.3.7.01c84fd" tandberg.model="528" hw.product="EX60">TANDBERG/528 (TC7.3.7.01c84fd) Cisco-EX60</example>
+    <example os.version="ce9.6.0.76c1685b70e" tandberg.model="529" hw.product="RoomKitMini">TANDBERG/529 (ce9.6.0.76c1685b70e) Cisco-RoomKitMini</example>
+    <param pos="0" name="os.vendor" value="Tandberg"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Linux"/>
+    <param pos="1" name="tandberg.model"/>
+    <param pos="2" name="os.version"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.family" value="TelePresence"/>
+    <param pos="0" name="hw.device" value="Video Conferencing"/>
+    <param pos="3" name="hw.product"/>
+  </fingerprint>
+
+  <fingerprint pattern="^(TANDBERG/(\d+)) \((\S+).*\)$">
+    <description>Cisco/Tandberg TelePresence</description>
+    <example os.version="TC7.0.2.aecf2d9" tandberg.model="519" hw.product="TANDBERG/519">TANDBERG/519 (TC7.0.2.aecf2d9)</example>
+    <example os.version="X12.5.2" tandberg.model="4137" hw.product="TANDBERG/4137">TANDBERG/4137 (X12.5.2 (TEST SW))</example>
+    <example os.version="X8.2.1" hw.product="TANDBERG/4130">TANDBERG/4130 (X8.2.1)</example>
+    <example os.version="XC2.2.1-b2bua-1.0" hw.product="TANDBERG/4353" tandberg.model="4353">TANDBERG/4353 (XC2.2.1-b2bua-1.0)</example>
+    <example os.version="TC5.1.4.295090" hw.product="TANDBERG/516" tandberg.model="516">TANDBERG/516 (TC5.1.4.295090)</example>
+    <example os.version="TCNC5.1.4.295090" hw.product="TANDBERG/517" tandberg.model="517">TANDBERG/517 (TCNC5.1.4.295090)</example>
+    <param pos="0" name="os.vendor" value="Tandberg"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="Linux"/>
+    <param pos="2" name="tandberg.model"/>
+    <param pos="3" name="os.version"/>
+    <param pos="0" name="hw.vendor" value="Cisco"/>
+    <param pos="0" name="hw.family" value="TelePresence"/>
+    <param pos="0" name="hw.device" value="Video Conferencing"/>
+    <param pos="1" name="hw.product"/>
+  </fingerprint>
+
+  <!-- Various -->
+
   <fingerprint pattern="EnGenius_Router$">
     <description>EnGenius DuraFon IP Phone</description>
     <example>EnGenius_Router</example>
@@ -101,6 +164,7 @@
     <param pos="0" name="hw.product" value="DuraFon"/>
     <param pos="0" name="hw.device" value="VoIP"/>
   </fingerprint>
+
   <fingerprint pattern="(?i)^Huawei (SoftX\d+) (?:V\d.*)$">
     <description>Huawei Softswitch</description>
     <example hw.model="SoftX3000">Huawei SoftX3000 V300R006</example>
@@ -109,11 +173,13 @@
     <param pos="0" name="hw.product" value="Softswitch"/>
     <param pos="1" name="hw.model"/>
   </fingerprint>
+
   <fingerprint pattern="(?i)^SIP/1.0 \(Huawei\)$">
     <description>Huawei generic</description>
     <example>SIP/1.0 (Huawei)</example>
     <param pos="0" name="hw.vendor" value="Huawei"/>
   </fingerprint>
+
   <fingerprint pattern="^M5T SIP(?: Stack|-UA SAFE)/v?([\d\.]+)">
     <description>Media5 Corporation SIP Stack</description>
     <example service.version="4.1.2.2">M5T SIP Stack/4.1.2.2</example>
@@ -124,17 +190,7 @@
     <param pos="1" name="service.version"/>
     <param pos="0" name="hw.device" value="VoIP"/>
   </fingerprint>
-  <fingerprint pattern="^TANDBERG/\d+ \(([a-zA-Z]+\d+(?:\.\d+)+).*\)">
-    <description>Cisco TelePresence</description>
-    <example os.version="X8.2.1">TANDBERG/4130 (X8.2.1)</example>
-    <example os.version="XC2.2.1">TANDBERG/4353 (XC2.2.1-b2bua-1.0)</example>
-    <example os.version="TC5.1.4.295090">TANDBERG/516 (TC5.1.4.295090)</example>
-    <example os.version="TCNC5.1.4.295090">TANDBERG/517 (TCNC5.1.4.295090)</example>
-    <example os.version="S5.30">TANDBERG/80 (S5.30)</example>
-    <param pos="0" name="os.vendor" value="Cisco"/>
-    <param pos="0" name="os.product" value="TelePresence"/>
-    <param pos="1" name="os.version"/>
-  </fingerprint>
+
   <fingerprint pattern="^Tilgin Vood ([^_\s]+)">
     <description>Tilgin Vood</description>
     <example hw.model="HG238x">Tilgin Vood HG238x_ESx000-02_07_03_26</example>
@@ -144,6 +200,7 @@
     <param pos="0" name="hw.product" value="Vood"/>
     <param pos="1" name="hw.model"/>
   </fingerprint>
+
   <fingerprint pattern="^(F\d{3})/VT?(\d(?:[\d\.A-Z]+))$">
     <description>ZTE GPON Router</description>
     <example hw.product="F620" hw.version="3.30.20P5T4S">F620/V3.30.20P5T4S</example>
@@ -154,6 +211,7 @@
     <param pos="1" name="hw.product"/>
     <param pos="2" name="hw.version"/>
   </fingerprint>
+
   <fingerprint pattern="^ZXDSL (\S+)/V?(\d(?:[\d\.A-Z_]+))$">
     <description>ZTE ZXDSL router</description>
     <example hw.product="931VII" hw.version="2.0.00.OTET06">ZXDSL 931VII/V2.0.00.OTET06</example>
@@ -163,6 +221,7 @@
     <param pos="1" name="hw.product"/>
     <param pos="2" name="hw.version"/>
   </fingerprint>
+
   <fingerprint pattern="^(?:ZXHN )?(H\d{3}N)/V?(\d(?:[\d\.A-Z_]+))$">
     <description>ZTE ZXHN router</description>
     <example hw.product="H218N" hw.version="1.02.01_ERS">ZXHN H218N/V1.02.01_ERS</example>
@@ -176,4 +235,120 @@
     <param pos="1" name="hw.product"/>
     <param pos="2" name="hw.version"/>
   </fingerprint>
-</fingerprints>
+
+  <fingerprint pattern="^Aastra ([^/]+)/([a-zA-Z0-9\.\-]+)$">
+    <description>Aastra IP Phone</description>
+    <example hw.product="6865i" os.version="4.2.0.2023">Aastra 6865i/4.2.0.2023</example>
+    <param pos="0" name="os.vendor" value="Aastra"/>
+    <param pos="0" name="os.family" value="VoIP"/>
+    <param pos="0" name="os.product" value="VoIP"/>
+    <param pos="2" name="os.version"/>
+    <param pos="0" name="hw.vendor" value="Aastra"/>
+    <param pos="0" name="hw.family" value="VoIP"/>
+    <param pos="0" name="hw.device" value="VoIP"/>
+    <param pos="1" name="hw.product"/>
+  </fingerprint>
+
+  <fingerprint pattern="^(?:Audiocodes-Sip-Gateway-)?(\S+) FX[A-Z_]+/v.(\S+)$">
+    <description>Audiocodes-Sip-Gateway</description>
+    <example hw.product="MP-124" os.version="6.00A.034.003">Audiocodes-Sip-Gateway-MP-124 FXS/v.6.00A.034.003</example>
+    <example hw.product="MP-124" os.version="6.60A.342.003">MP-124 FXS/v.6.60A.342.003</example>
+    <example hw.product="MP-114" os.version="6.60A.241.010">MP-114 FXS_FXO/v.6.60A.241.010</example>
+    <param pos="0" name="os.vendor" value="AudioCodes"/>
+    <param pos="0" name="os.family" value="SIP Gateway"/>
+    <param pos="2" name="os.version"/>
+    <param pos="0" name="hw.vendor" value="AudioCodes"/>
+    <param pos="0" name="hw.family" value="SIP Gateway"/>
+    <param pos="0" name="hw.device" value="SIP Gateway"/>
+    <param pos="1" name="hw.product"/>
+  </fingerprint>
+
+  <fingerprint pattern="^Wildix GW-(\S+)$">
+    <description>Wildix SIP Gateway</description>
+    <example os.version="5.0.3.42145">Wildix GW-5.0.3.42145</example>
+    <param pos="0" name="os.vendor" value="Wildix"/>
+    <param pos="0" name="os.family" value="SIP Gateway"/>
+    <param pos="1" name="os.version"/>
+    <param pos="0" name="hw.vendor" value="Wildix"/>
+    <param pos="0" name="hw.family" value="SIP Gateway"/>
+    <param pos="0" name="hw.device" value="SIP Gateway"/>
+    <param pos="0" name="hw.product" value="SIP Gateway"/>
+  </fingerprint>
+
+  <fingerprint pattern="^Wildix GW$">
+    <description>Wildix SIP Gateway w/o Version</description>
+    <example>Wildix GW</example>
+    <param pos="0" name="os.vendor" value="Wildix"/>
+    <param pos="0" name="os.family" value="SIP Gateway"/>
+    <param pos="0" name="hw.vendor" value="Wildix"/>
+    <param pos="0" name="hw.family" value="SIP Gateway"/>
+    <param pos="0" name="hw.device" value="SIP Gateway"/>
+    <param pos="0" name="hw.product" value="SIP Gateway"/>
+  </fingerprint>
+
+  <fingerprint pattern="^Asterisk PBX (\S+)$">
+    <description>Asterisk PBX w/ Version</description>
+    <example service.version="13.18.0-6.7.1.1.rl.1538157944.1c65507">Asterisk PBX 13.18.0-6.7.1.1.rl.1538157944.1c65507</example>
+    <example service.version="16.2.1~dfsg-1">Asterisk PBX 16.2.1~dfsg-1</example>
+    <param pos="0" name="service.vendor" value="Asterisk"/>
+    <param pos="0" name="service.family" value="PBX"/>
+    <param pos="0" name="service.product" value="PBX"/>
+    <param pos="1" name="service.version"/>
+  </fingerprint>
+
+  <fingerprint pattern="^Asterisk PBX$">
+    <description>Asterisk PBX w/o Version</description>
+    <example>Asterisk PBX</example>
+    <param pos="0" name="service.vendor" value="Asterisk"/>
+    <param pos="0" name="service.family" value="PBX"/>
+    <param pos="0" name="service.product" value="PBX"/>
+  </fingerprint>
+
+  <fingerprint pattern="^FPBX-(\S+)$">
+    <description>FreePBX</description>
+    <example service.version="12.0.70(11.20.0)">FPBX-12.0.70(11.20.0)</example>
+    <example service.version="2.11.0(11.20.0)">FPBX-2.11.0(11.20.0)</example>
+    <param pos="0" name="service.vendor" value="FreePBX"/>
+    <param pos="0" name="service.family" value="PBX"/>
+    <param pos="0" name="service.product" value="PBX"/>
+    <param pos="1" name="service.version"/>
+  </fingerprint>
+
+  <fingerprint pattern="^kamailio \((\S+) \((.*)\)\)$">
+    <description>Kamailio SIP Server</description>
+    <example service.version="4.4.4" kamailio.platform="x86_64/linux">kamailio (4.4.4 (x86_64/linux))</example>
+    <param pos="0" name="service.vendor" value="Kamailio"/>
+    <param pos="0" name="service.family" value="SIP Server"/>
+    <param pos="0" name="service.product" value="SIP Server"/>
+    <param pos="1" name="service.version"/>
+    <param pos="2" name="kamailio.platform"/>
+  </fingerprint>
+
+  <!-- This match covers multiple product families and should be split up further -->
+
+  <fingerprint pattern="^Algo-([^/]+)/(.*)$">
+    <description>Algo SIP Device</description>
+    <example hw.product="8186" os.version="1.7">Algo-8186/1.7</example>
+    <param pos="0" name="os.vendor" value="Algo"/>
+    <param pos="0" name="os.family" value="SIP Device"/>
+    <param pos="2" name="os.version"/>
+    <param pos="0" name="hw.vendor" value="Algo"/>
+    <param pos="0" name="hw.family" value="SIP Device"/>
+    <param pos="0" name="hw.device" value="SIP Device"/>
+    <param pos="1" name="hw.product"/>
+  </fingerprint>
+
+  <fingerprint pattern="^(?:SIParator|Ingate-Firewall)/(\S+)$">
+    <description>Ingate SIParator Firewall</description>
+    <example os.version="5.0.10">Ingate-Firewall/5.0.10</example>
+    <example os.version="6.0.4">SIParator/6.0.4</example>
+    <param pos="0" name="os.vendor" value="Ingate"/>
+    <param pos="0" name="os.family" value="SIP Gateway"/>
+    <param pos="1" name="os.version"/>
+    <param pos="0" name="hw.vendor" value="Ingate"/>
+    <param pos="0" name="hw.family" value="SIP Gateway"/>
+    <param pos="0" name="hw.device" value="SIP Gateway"/>
+    <param pos="0" name="hw.product" value="SIParator Firewall"/>
+  </fingerprint>
+
+</fingerprints>