What is Banner Grabbing?

Banner grabbing is the practice of connecting to a network service and capturing its banner — the greeting or response text a service sends when a client connects. Banners frequently identify the software and its exact version: an SSH server might announce SSH-2.0-OpenSSH_9.6, an SMTP server its mail software, and a web server its name via the Server HTTP header.

How it works

Banner grabbing can be as simple as opening a raw TCP connection and reading what the service sends, or issuing a minimal protocol request (such as an HTTP HEAD) and reading the response headers. Scanning tools automate this across every open port found by a port scan.

Why banners matter

A version string turns an open port into an actionable finding. Once the software and version are known, they can be matched against CVE databases to identify unpatched vulnerabilities — which is exactly what both attackers and vulnerability scanners do. Search engines such as Shodan and Censys have already banner-grabbed most of the internet, so exposed version information is effectively public.

Banner grabbing vs service fingerprinting

Banner grabbing reads what a service voluntarily announces; service fingerprinting goes further, inferring the service from protocol behaviour even when banners are hidden or falsified. Suppressing banners is a mild hardening measure, but it is obscurity rather than protection — patching the software behind the banner is what removes the risk.