search

robertdavidgraham / masscan

TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
GNU Affero General Public License v3.0
23.46k stars 3.06k forks source link

Ref. Id meaning & documentation #758

Closed acidvegas closed 8 months ago

acidvegas commented 8 months ago 
{   "ip": "208.75.68.66",   "timestamp": "1705506092", "ports": [ {"port": 43, "proto": "tcp", "service": {"name": "unknown", "banner": "(Ref.Id: ?slKvOsqzkje47CES54jgEkk4Wa5Ek?)"} } ] }
{   "ip": "67.60.176.238",   "timestamp": "1705506188", "ports": [ {"port": 43, "proto": "tcp", "service": {"name": "unknown", "banner": "(Ref.Id: ?sKfYRsC4M4a2W8PaC4zF?)"} } ] }
{   "ip": "82.96.12.5",   "timestamp": "1705507037", "ports": [ {"port": 43, "proto": "tcp", "service": {"name": "unknown", "banner": "(Ref.Id: ?sKfOvsC4M4a2W8PaC4zF?)"} } ] }
{   "ip": "195.230.35.249",   "timestamp": "1705507090", "ports": [ {"port": 43, "proto": "tcp", "service": {"name": "unknown", "banner": "(Ref.Id: ?sKfYRsC4M4a2W8PaC4zF?)"} } ] }
{   "ip": "213.33.114.183",   "timestamp": "1705507107", "ports": [ {"port": 43, "proto": "tcp", "service": {"name": "unknown", "banner": "(Ref.Id: ?sKfYRsC4M4a2W8PaC4zF?)"} } ] }

What exactly is the "Ref.Id" here? How is it determined and what is it used for. I really have not seen much people discussing this at all so I am a little clueless.

p-l- commented 8 months ago

This is the raw banner sent by the server as Masscan received it. It has nothing specific to Masscan.