> ## Documentation Index > Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt > Use this file to discover all available pages before exploring further. # Protocols S–Z > Protocol-specific service search fields in Protocols S–Z Protocol-specific service search fields in Protocols S–Z. Dataset: `services` TSAP destination that completed setup communication. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Firmware version from SZL module identification records. Operators: `:` `=` `!=` `=~` `:~`. Hardware version from SZL module identification records. Operators: `:` `=` `!=` `=~` `:~`. Installation location from component identification records. Operators: `:` `=` `!=` `=~` `:~`. Module identifier string from SZL module identification records. Operators: `:` `=` `!=` `=~` `:~`. Module name from component identification records. Operators: `:` `=` `!=` `=~` `:~`. Module type from component identification records. Operators: `:` `=` `!=` `=~` `:~`. Plant identifier from component identification records. Operators: `:` `=` `!=` `=~` `:~`. Device serial number from component identification records. Operators: `:` `=` `!=` `=~` `:~`. System name from component identification records. Operators: `:` `=` `!=` `=~` `:~`. Initial control opcode observed from the server. Operators: `:` `=` `!=` `=~` `:~`. Protocol version if present in the register-ack payload. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Response type from the SCCP server. Operators: `:` `=` `!=` `=~` `:~`. Steam app ID. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Source game description. Operators: `:` `=` `!=` `=~` `:~`. Source game directory. Operators: `:` `=` `!=` `=~` `:~`. Operators: `:` `=` `!=` `=~` `:~`. Optional full 64-bit Source game ID from the EDF tail. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Operators: `:` `=` `!=` `=~` `:~`. Operators: `:` `=` `!=` `=~` `:~`. 7DTD metadata fields parsed from the keywords string. Operators: `:` `=` `!=` `=~` `:~`. Raw Source keywords string, which carries the 7DTD metadata blob. Operators: `:` `=` `!=` `=~` `:~`. Operators: `:` `=` `!=` `=~` `:~`. Active map or level name from the A2S INFO response. Operators: `:` `=` `!=` `=~` `:~`. Maximum player slots. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Server operating system (linux/windows/macos). Operators: `:` `=` `!=` `=~` `:~`. Operators: `:` `=` `!=` `=~` `:~`. Operators: `:` `=` `!=` `=~` `:~`. Current player count. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Whether the server is private/passworded. Operators: `:` `=` `!=`. Whether VAC is enabled. Operators: `:` `=` `!=`. Operators: `:` `=` `!=` `=~` `:~`. Operators: `:` `=` `!=` `=~` `:~`. Source server name from the A2S INFO response. Operators: `:` `=` `!=` `=~` `:~`. Server type (dedicated/listen/proxy). Operators: `:` `=` `!=` `=~` `:~`. Operators: `:` `=` `!=` `=~` `:~`. Operators: `:` `=` `!=` `=~` `:~`. Reported server build/version from A2S INFO. Operators: `:` `=` `!=` `=~` `:~`. List of allow methods. Operators: `:` `=` `!=` `=~` `:~`. Code. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Server. Operators: `:` `=` `!=` `=~` `:~`. Status. Operators: `:` `=` `!=` `=~` `:~`. List of supported extensions. Operators: `:` `=` `!=` `=~` `:~`. Version. Operators: `:` `=` `!=` `=~` `:~`. SLP response error code. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. SLP function identifier in the response. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Human-readable SLP function name. Operators: `:` `=` `!=` `=~` `:~`. Language tag from response headers. Operators: `:` `=` `!=` `=~` `:~`. Service URLs returned by the responder. Operators: `:` `=` `!=` `=~` `:~`. Number of URLs returned for service replies. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Transaction identifier. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Whether anonymous session access succeeded. Operators: `:` `=` `!=`. Authentication mode (anonymous, required, unknown). Operators: `:` `=` `!=` `=~` `:~`. Protocol capabilities. Operators: `:` `=` `!=` `=~` `:~`. Negotiated dialect label. Operators: `:` `=` `!=` `=~` `:~`. NTLM DNS computer name from challenge metadata. Friendly label: `NTLM DNS Computer`. Operators: `:` `=` `!=` `=~` `:~`. NTLM DNS domain name from challenge metadata. Friendly label: `NTLM DNS Domain`. Operators: `:` `=` `!=` `=~` `:~`. NTLM DNS forest/tree name from challenge metadata. Friendly label: `NTLM DNS Tree`. Operators: `:` `=` `!=` `=~` `:~`. NTLM NetBIOS computer name from challenge metadata. Friendly label: `NTLM NetBIOS Computer`. Operators: `:` `=` `!=` `=~` `:~`. NTLM NetBIOS domain name from challenge metadata. Friendly label: `NTLM NetBIOS Domain`. Operators: `:` `=` `!=` `=~` `:~`. NTLM target name from challenge metadata. Friendly label: `NTLM Target Name`. Operators: `:` `=` `!=` `=~` `:~`. Native operating system hint. Operators: `:` `=` `!=` `=~` `:~`. Whether message signing is enabled. Operators: `:` `=` `!=`. Whether message signing is required. Operators: `:` `=` `!=`. Preferred SMB major version (1 or 2). Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Native software hint. Operators: `:` `=` `!=` `=~` `:~`. Whether SMB1 was observed. Operators: `:` `=` `!=`. Whether SMB2+ was observed. Operators: `:` `=` `!=`. Share comment. Operators: `:` `=` `!=` `=~` `:~`. Whether share is special. Operators: `:` `=` `!=`. Whether share is temporary. Operators: `:` `=` `!=`. Share kind (disk, ipc, printer, device, unknown). Operators: `:` `=` `!=` `=~` `:~`. Share name. Operators: `:` `=` `!=` `=~` `:~`. Whether entry is a directory. Operators: `:` `=` `!=`. Entry name. Operators: `:` `=` `!=` `=~` `:~`. Whether entry is read-only. Operators: `:` `=` `!=`. Entry size in bytes. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. SMPP command status from the response header. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Interface version from optional TLV, if present. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Response type observed from the server. Operators: `:` `=` `!=` `=~` `:~`. System ID returned by bind responses, if present. Operators: `:` `=` `!=` `=~` `:~`. Authentication mechanisms derived from AUTH capability. Operators: `:` `=` `!=` `=~` `:~`. EHLO capability lines, normalized and deduped. Operators: `:` `=` `!=` `=~` `:~`. Server greeting line as received (CRLF preserved when present). Operators: `:` `=` `!=` `=~` `:~`. Parsed SMTP reply code from greeting, when present. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Greeting text after the SMTP reply code. Operators: `:` `=` `!=` `=~` `:~`. Maximum advertised message size parsed from SIZE capability. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Optional software hint extracted from greeting text (e.g. Postfix, Exim). Operators: `:` `=` `!=` `=~` `:~`. True when STARTTLS reply indicates acceptance. Operators: `:` `=` `!=`. STARTTLS command reply line. Operators: `:` `=` `!=` `=~` `:~`. True when STARTTLS is advertised in capabilities. Operators: `:` `=` `!=`. True when scan connected with implicit TLS (usually port 465). Operators: `:` `=` `!=`. List of observed versions. Operators: `:` `=` `!=` `=~` `:~`. Boots counter. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Engine ID hex. Operators: `:` `=` `!=` `=~` `:~`. Engine uptime seconds in seconds. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Enterprise name. Operators: `:` `=` `!=` `=~` `:~`. Enterprise number. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. ID layout. Operators: `:` `=` `!=` `=~` `:~`. Probe descriptor. Operators: `:` `=` `!=` `=~` `:~`. Whether uses rfc3411 layout. Operators: `:` `=` `!=`. Greeting banner line observed from the service. Operators: `:` `=` `!=` `=~` `:~`. Whether auth required. Operators: `:` `=` `!=`. Version. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Active user. Operators: `:` `=` `!=` `=~` `:~`. Brand display name. Operators: `:` `=` `!=` `=~` `:~`. Client ID. Operators: `:` `=` `!=` `=~` `:~`. Device ID. Operators: `:` `=` `!=` `=~` `:~`. Device type. Operators: `:` `=` `!=` `=~` `:~`. Library version. Operators: `:` `=` `!=` `=~` `:~`. Model display name. Operators: `:` `=` `!=` `=~` `:~`. Remote name. Operators: `:` `=` `!=` `=~` `:~`. Scope. Operators: `:` `=` `!=` `=~` `:~`. Version. Operators: `:` `=` `!=` `=~` `:~`. Boot ID from BOOTID.UPNP.ORG when present. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Cache lifetime parsed from CACHE-CONTROL max-age. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Config ID from CONFIGID.UPNP.ORG when present. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Device description URL from the LOCATION header. Operators: `:` `=` `!=` `=~` `:~`. Search target from the ST header. Operators: `:` `=` `!=` `=~` `:~`. Software and UPnP stack hint from the SERVER header. Operators: `:` `=` `!=` `=~` `:~`. HTTP status code from the M-SEARCH response. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. HTTP status line from the responder. Operators: `:` `=` `!=` `=~` `:~`. Unique service name from the USN header. Operators: `:` `=` `!=` `=~` `:~`. Client ID. Operators: `:` `=` `!=` `=~` `:~`. Server ID. Included in overview projections. Operators: `:` `=` `!=` `=~` `:~`. Host key algorithm. Operators: `:` `=` `!=` `=~` `:~`. Kex algorithm. Operators: `:` `=` `!=` `=~` `:~`. Cipher. Operators: `:` `=` `!=` `=~` `:~`. Compression. Operators: `:` `=` `!=` `=~` `:~`. Mac. Operators: `:` `=` `!=` `=~` `:~`. Cipher. Operators: `:` `=` `!=` `=~` `:~`. Compression. Operators: `:` `=` `!=` `=~` `:~`. Mac. Operators: `:` `=` `!=` `=~` `:~`. Protocol version. Operators: `:` `=` `!=` `=~` `:~`. Software version. Operators: `:` `=` `!=` `=~` `:~`. List of compression algorithms client to server. Operators: `:` `=` `!=` `=~` `:~`. List of compression algorithms server to client. Operators: `:` `=` `!=` `=~` `:~`. List of encryption algorithms client to server. Operators: `:` `=` `!=` `=~` `:~`. List of encryption algorithms server to client. Operators: `:` `=` `!=` `=~` `:~`. List of kex algorithms. Operators: `:` `=` `!=` `=~` `:~`. List of mac algorithms client to server. Operators: `:` `=` `!=` `=~` `:~`. List of mac algorithms server to client. Operators: `:` `=` `!=` `=~` `:~`. List of server host key algorithms. Operators: `:` `=` `!=` `=~` `:~`. List of client to server ciphers. Operators: `:` `=` `!=` `=~` `:~`. List of client to server compression. Operators: `:` `=` `!=` `=~` `:~`. List of client to server languages. Operators: `:` `=` `!=` `=~` `:~`. List of client to server macs. Operators: `:` `=` `!=` `=~` `:~`. Whether first kex follows. Operators: `:` `=` `!=`. List of host key algorithms. Operators: `:` `=` `!=` `=~` `:~`. List of kex algorithms. Operators: `:` `=` `!=` `=~` `:~`. List of server to client ciphers. Operators: `:` `=` `!=` `=~` `:~`. List of server to client compression. Operators: `:` `=` `!=` `=~` `:~`. List of server to client languages. Operators: `:` `=` `!=` `=~` `:~`. List of server to client macs. Operators: `:` `=` `!=` `=~` `:~`. Number of parsed instances. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. SSRP message type from response header. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Whether the instance reports clustering enabled. Operators: `:` `=` `!=`. SQL instance name. Operators: `:` `=` `!=` `=~` `:~`. SQL instance named pipe endpoint. Operators: `:` `=` `!=` `=~` `:~`. SQL host/server name. Operators: `:` `=` `!=` `=~` `:~`. SQL instance TCP listener port. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. SQL instance version string. Operators: `:` `=` `!=` `=~` `:~`. Whether broadcasting is active. Operators: `:` `=` `!=`. Steam client identifier from the broadcast header. Operators: `:` `=` `!=` `=~` `:~`. Reported remote connection port. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Enabled service bitmask. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Reported Steam universe. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Whether games are currently running. Operators: `:` `=` `!=`. Reported device hostname. Operators: `:` `=` `!=` `=~` `:~`. Steam instance identifier from the broadcast header. Operators: `:` `=` `!=` `=~` `:~`. Reported private or LAN addresses. Operators: `:` `=` `!=` `=~` `:~`. Whether the remote device reports a 64-bit OS. Operators: `:` `=` `!=`. Reported MAC addresses. Operators: `:` `=` `!=` `=~` `:~`. Normalized broadcast message type. Operators: `:` `=` `!=` `=~` `:~`. Minimum supported Steam IHS protocol version. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Reported operating system type. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Reported public IP address. Operators: `:` `=` `!=` `=~` `:~`. Whether Remote Play is active. Operators: `:` `=` `!=`. Whether the screen is currently locked. Operators: `:` `=` `!=`. Whether the device identifies as a Steam Deck. Operators: `:` `=` `!=`. Reported Steam client build/version identifier. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Supported service bitmask. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Reported device timestamp in RFC3339 format. Operators: `:` `=` `!=` `=~` `:~`. Reported Steam IHS protocol version. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Whether VR streaming is active. Operators: `:` `=` `!=`. SteamID encoded as a decimal string. Operators: `:` `=` `!=` `=~` `:~`. Content-Type header value when present. Operators: `:` `=` `!=` `=~` `:~`. Error body when present. Operators: `:` `=` `!=` `=~` `:~`. STOMP frame command (e.g. CONNECTED, ERROR). Operators: `:` `=` `!=` `=~` `:~`. Heart-beat header value when present. Operators: `:` `=` `!=` `=~` `:~`. Negotiated STOMP protocol version. Operators: `:` `=` `!=` `=~` `:~`. Server header value when present. Operators: `:` `=` `!=` `=~` `:~`. Count of parsed STUN attributes. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. True when FINGERPRINT attribute is present. Operators: `:` `=` `!=`. STUN message class (success, error, request, indication). Operators: `:` `=` `!=` `=~` `:~`. True when MESSAGE-INTEGRITY attribute is present. Operators: `:` `=` `!=`. STUN method number. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. REALM attribute value when present. Operators: `:` `=` `!=` `=~` `:~`. SOFTWARE attribute value when present. Operators: `:` `=` `!=` `=~` `:~`. IP address extracted from STUN attributes. Operators: `:` `=` `!=` `=~` `:~`. Port extracted from STUN attributes. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Numeric STUN error code. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Human-readable STUN error reason phrase. Operators: `:` `=` `!=` `=~` `:~`. IP address extracted from STUN attributes. Operators: `:` `=` `!=` `=~` `:~`. Port extracted from STUN attributes. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. IP address extracted from STUN attributes. Operators: `:` `=` `!=` `=~` `:~`. Port extracted from STUN attributes. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Reported daemon name. Operators: `:` `=` `!=` `=~` `:~`. Parsed protocol error code. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Normalized textual message. Operators: `:` `=` `!=` `=~` `:~`. Whether the daemon reported a remote-side error path. Operators: `:` `=` `!=`. Supported authentication mechanisms. Operators: `:` `=` `!=` `=~` `:~`. Supported server capabilities. Operators: `:` `=` `!=` `=~` `:~`. Maximum protocol version advertised by the server. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Minimum protocol version advertised by the server. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Authentication status from AUTHEN/REPLY packets. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Human-readable authentication status. Operators: `:` `=` `!=` `=~` `:~`. True when the server indicated encrypted body semantics. Operators: `:` `=` `!=`. TACACS+ body length from the header. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. TACACS+ flags byte. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. TACACS+ packet type (authentication/authorization/accounting). Operators: `:` `=` `!=` `=~` `:~`. TACACS+ sequence number. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Server message from AUTHEN/REPLY when present. Operators: `:` `=` `!=` `=~` `:~`. TACACS+ major version. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. TACACS+ minor version. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Build or release identifier reported by the query interface. Operators: `:` `=` `!=` `=~` `:~`. TeamSpeak major generation, such as "2" or "3". Operators: `:` `=` `!=` `=~` `:~`. Interface variant used to identify the service, such as "serverquery", "tcpquery", or "voice". Operators: `:` `=` `!=` `=~` `:~`. Platform or operating system string reported by the server. Operators: `:` `=` `!=` `=~` `:~`. Server name advertised by TeamSpeak 2 voice discovery. Operators: `:` `=` `!=` `=~` `:~`. Server version reported by the query interface or inferred from a fixed voice-protocol signature. Operators: `:` `=` `!=` `=~` `:~`. List of do option codes. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. List of do option names. Operators: `:` `=` `!=` `=~` `:~`. List of dont option codes. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. List of dont option names. Operators: `:` `=` `!=` `=~` `:~`. True when START\_TLS option (46) was observed. Operators: `:` `=` `!=`. Number of iac command count. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Whether negotiation seen. Operators: `:` `=` `!=`. Printable text emitted before authentication (banner/prompts). Operators: `:` `=` `!=` `=~` `:~`. List of will option codes. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. List of will option names. Operators: `:` `=` `!=` `=~` `:~`. List of wont option codes. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. List of wont option names. Operators: `:` `=` `!=` `=~` `:~`. Option code. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Option name. Operators: `:` `=` `!=` `=~` `:~`. Block number from DATA/ACK packets when present. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. DATA payload size in bytes. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. TFTP error code from ERROR packets when present. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. TFTP error message from ERROR packets. Operators: `:` `=` `!=` `=~` `:~`. True when an OACK packet was observed. Operators: `:` `=` `!=`. First response opcode. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Symbolic response opcode label. Operators: `:` `=` `!=` `=~` `:~`. Source UDP port used by the responder for transfer traffic. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Transfer mode echoed from the request. Operators: `:` `=` `!=` `=~` `:~`. Option key name. Operators: `:` `=` `!=` `=~` `:~`. Option value. Operators: `:` `=` `!=` `=~` `:~`. Listener error code when present. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Listener error details when present. Operators: `:` `=` `!=` `=~` `:~`. Listener version string when present. Operators: `:` `=` `!=` `=~` `:~`. TNS packet type value from the response header. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Human-readable TNS packet type. Operators: `:` `=` `!=` `=~` `:~`. Raw VSNNUM value when present. Operators: `:` `=` `!=` `=~` `:~`. ERROR-CODE attribute if provided. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. REALM attribute if provided. Operators: `:` `=` `!=` `=~` `:~`. SOFTWARE attribute if provided. Operators: `:` `=` `!=` `=~` `:~`. Ubiquiti discovery response command value. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Adoption/configuration status when present. Operators: `:` `=` `!=` `=~` `:~`. Wireless ESSID when present. Operators: `:` `=` `!=` `=~` `:~`. Firmware string when present. Operators: `:` `=` `!=` `=~` `:~`. Device hostname when present. Operators: `:` `=` `!=` `=~` `:~`. Observed interface IP addresses. Operators: `:` `=` `!=` `=~` `:~`. Observed MAC addresses. Operators: `:` `=` `!=` `=~` `:~`. Management port when advertised. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Model string when present. Operators: `:` `=` `!=` `=~` `:~`. Product string when present. Operators: `:` `=` `!=` `=~` `:~`. Ubiquiti discovery protocol version (1 or 2). Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Software version when present. Operators: `:` `=` `!=` `=~` `:~`. Uptime in seconds when present. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. PLC hardware revision. Operators: `:` `=` `!=` `=~` `:~`. Human-readable PLC model when recognized. Operators: `:` `=` `!=` `=~` `:~`. Raw PLC model code returned by the device. Operators: `:` `=` `!=` `=~` `:~`. PLC operating system build number. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. PLC operating system version in major.minor form. Operators: `:` `=` `!=` `=~` `:~`. PLC name configured on the controller. Operators: `:` `=` `!=` `=~` `:~`. PLC unique identifier. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Unit ID of the PCOM master PLC. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Callsigns observed in position/update traffic. Operators: `:` `=` `!=` `=~` `:~`. Recipient identifier from the \$DI greeting. Operators: `:` `=` `!=` `=~` `:~`. True when position/update traffic was also observed. Operators: `:` `=` `!=`. Sender identifier from the \$DI greeting. Operators: `:` `=` `!=` `=~` `:~`. Advertised FSD version string. Operators: `:` `=` `!=` `=~` `:~`. Supported feature flags from the banner tail. Operators: `:` `=` `!=` `=~` `:~`. Greeting status code. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Greeting text after the numeric status code. Operators: `:` `=` `!=` `=~` `:~`. Advertised MKS display protocol, when present. Operators: `:` `=` `!=` `=~` `:~`. Advertised server daemon protocol, when present. Operators: `:` `=` `!=` `=~` `:~`. True when the banner requires SSL/TLS. Operators: `:` `=` `!=`. Authentication daemon version string. Operators: `:` `=` `!=` `=~` `:~`. Security types as raw numeric IDs. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Security types decoded to labels. Operators: `:` `=` `!=` `=~` `:~`. Best-effort implementation/vendor family hint. Operators: `:` `=` `!=` `=~` `:~`. Raw banner version string from the server (e.g. "003.008"). Operators: `:` `=` `!=` `=~` `:~`. Advertised public T3 endpoint, when included in the handshake. Operators: `:` `=` `!=` `=~` `:~`. First T3 response type observed from the server. Operators: `:` `=` `!=` `=~` `:~`. Parsed server version when the response exposes a trustworthy version string. Operators: `:` `=` `!=` `=~` `:~`. Referral WHOIS server endpoint if present in response metadata. Operators: `:` `=` `!=` `=~` `:~`. Product name extracted from the banner. Operators: `:` `=` `!=` `=~` `:~`. Whether the session exposed the interactive prompt. Operators: `:` `=` `!=`. Version string from the WinAQMS data server greeting. Operators: `:` `=` `!=` `=~` `:~`. Direction of the connection banner. Operators: `:` `=` `!=` `=~` `:~`. Reported connection protocol version, e.g. "V2". Operators: `:` `=` `!=` `=~` `:~`. SOAP action from the response header when present. Operators: `:` `=` `!=` `=~` `:~`. SOAP fault reason when present. Operators: `:` `=` `!=` `=~` `:~`. True when the response body is a SOAP fault. Operators: `:` `=` `!=`. WS-Addressing message identifier. Operators: `:` `=` `!=` `=~` `:~`. Advertised type list. Operators: `:` `=` `!=` `=~` `:~`. Advertised service addresses. Operators: `:` `=` `!=` `=~` `:~`. True when the endpoint requires authentication. Operators: `:` `=` `!=`. Authentication schemes offered in WWW-Authenticate headers. Operators: `:` `=` `!=` `=~` `:~`. SOAP fault code when the endpoint returned a WS-Man fault. Operators: `:` `=` `!=` `=~` `:~`. SOAP fault reason when the endpoint returned a WS-Man fault. Operators: `:` `=` `!=` `=~` `:~`. Product vendor reported by Identify. Operators: `:` `=` `!=` `=~` `:~`. Product version reported by Identify. Operators: `:` `=` `!=` `=~` `:~`. WS-Management protocol URI reported by Identify. Operators: `:` `=` `!=` `=~` `:~`. Classification of the first protocol-specific response. Operators: `:` `=` `!=` `=~` `:~`. Optional failure reason text. Operators: `:` `=` `!=` `=~` `:~`. X11 protocol major version. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. X11 protocol minor version. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Setup status returned by the X11 server. Operators: `:` `=` `!=` `=~` `:~`. Optional X11 vendor string on successful setup. Operators: `:` `=` `!=` `=~` `:~`. Protocol banner prefix, e.g. XBMSP-1.0. Operators: `:` `=` `!=` `=~` `:~`. Advertised protocol version token. Operators: `:` `=` `!=` `=~` `:~`. Server product name. Operators: `:` `=` `!=` `=~` `:~`. Trailing server version or build token. Operators: `:` `=` `!=` `=~` `:~`. Authentication name selected by a Willing response. Operators: `:` `=` `!=` `=~` `:~`. Human-readable manager hostname string. Operators: `:` `=` `!=` `=~` `:~`. Whether the manager answered Willing or Unwilling. Operators: `:` `=` `!=` `=~` `:~`. Human-readable manager status string. Operators: `:` `=` `!=` `=~` `:~`. Advertised server capabilities. Operators: `:` `=` `!=` `=~` `:~`. Greeting family, typically "ELocatorHello". Operators: `:` `=` `!=` `=~` `:~`. Xicom version token when advertised, e.g. "Xicom\_v1.00". Operators: `:` `=` `!=` `=~` `:~`. Stream error (for example host-unknown). Operators: `:` `=` `!=` `=~` `:~`. Whether the scan used implicit TLS. Operators: `:` `=` `!=`. Entity capabilities node. Operators: `:` `=` `!=` `=~` `:~`. Entity capabilities verification string. Operators: `:` `=` `!=` `=~` `:~`. SASL mechanisms. Operators: `:` `=` `!=` `=~` `:~`. Whether STARTTLS is offered. Operators: `:` `=` `!=`. Whether STARTTLS is required. Operators: `:` `=` `!=`. Stream from address. Operators: `:` `=` `!=` `=~` `:~`. Stream id. Operators: `:` `=` `!=` `=~` `:~`. Stream namespace. Operators: `:` `=` `!=` `=~` `:~`. Stream to address. Operators: `:` `=` `!=` `=~` `:~`. Stream version. Operators: `:` `=` `!=` `=~` `:~`. Command. Operators: `:` `=` `!=` `=~` `:~`. Mechanism. Operators: `:` `=` `!=` `=~` `:~`. Whether signature valid. Operators: `:` `=` `!=`. Socket type. Operators: `:` `=` `!=` `=~` `:~`. Zmtp version. Operators: `:` `=` `!=` `=~` `:~`. Reported active client connection count. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Server mode (leader, follower, standalone, read-only). Operators: `:` `=` `!=` `=~` `:~`. Reported znode count. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Whether the server reports read-only mode. Operators: `:` `=` `!=`. Zookeeper version from 4lw output. Operators: `:` `=` `!=` `=~` `:~`. RCON packet ID. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. RCON packet size field. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. RCON packet type (e.g. SERVERDATA\_RESPONSE\_VALUE=0). Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Steam app ID. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Source game description. Operators: `:` `=` `!=` `=~` `:~`. Source game directory. Operators: `:` `=` `!=` `=~` `:~`. Active map name. Operators: `:` `=` `!=` `=~` `:~`. Maximum player slots. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Source server name. Operators: `:` `=` `!=` `=~` `:~`. Server operating system (linux/windows/macos). Operators: `:` `=` `!=` `=~` `:~`. Current player count. Operators: `:` `=` `!=` `<` `<=` `>` `>=`. Whether server is private/passworded. Operators: `:` `=` `!=`. Whether VAC is enabled. Operators: `:` `=` `!=`. Server type (dedicated/listen/proxy). Operators: `:` `=` `!=` `=~` `:~`. Reported game/server version. Operators: `:` `=` `!=` `=~` `:~`.