Design Goals

Scanner has to answer two questions:
What is the ratio between SSH v2 servers to SSH v1 servers on the Internet?
Which hosts on a network run vulnerable SSH servers?

Determine server's protocol version by looking at first message in SSH  protocol:
Both sides must send an identification of the form SSH-protoversion-softwareversion.
Servers supporting SSH v2 use protocol version 1.99 or 2.0.

Information contained in the softwareversion field allows to determine vulnerable servers.