Another excellent option for performing banner-grabbing reconnaissance is to use the Nmap NSE script. This can be an effective option for streamlining the information-gathering process in two ways: first, because Nmap is already likely going to be among your arsenal of tools that will be used for target and service discovery, and second, because the process of banner grabbing can be run in conjunction with these scans. A TCP connect scan with the additional --script option and the banner argument can accomplish the task of both service enumeration and banner grabbing.