Reconnaissance and exfiltration
Banner grabbing
Reading the greeting a service sends on connect, to learn the real software and version behind a port.
A port number is only a convention: a scanner labels 22 "ssh" from a table, not from what answers. Connecting and
reading the first bytes — an SSH server's SSH-2.0-<software> line, a web server's response headers — names the actual
software and version, which is what turns a list of open ports into a list of things to check for known weaknesses.