Community

banshee is under active development: collectors will keep changing, and a version you publish will likely need adjustments. For stable use, wait for version 1.0.0.

Examples

banshee/examples-collection/examples/protocols/

tls-inspect

Example: tls.inspect, the certificate a port presents; the days before it expires.

  • example
  • protocol
  • tls
  • certificate

by banshee1 installation1 version

v1Latest

Published on October 27, 2026. First version in this collection.

Protocol: tls.inspect

tls.inspect makes a TLS handshake to a port of the host, reads the certificate presented and judges it, without ever refusing it. Here, the days left before it expires.

How to read it

  • need('host:address'): the address of the host, the one tls.inspect joins. It sends nothing but the handshake.
  • The answer holds version, suite, trusted, name_matches, chain and certificates, the chain as the server presents it, its own certificate first: $found['certificates'][0].
  • Each certificate holds days_left, self_issued, key, key_bits, signature and more.
  • A server that no handshake reaches stops the collector, unreachable: the probe never says a certificate is fine when it could not read it.

To adapt it

  • Another port: tls.inspect(636) for LDAPS, name= for the name expected when it is not the address, preamble='rdp' for the port 3389.
  • The full certificate probe is network/tls/certificate, in the language contract.