Banner is whatever information a remote connection gives you when you connect. For ssh that will be some information about the server, version of ssh, hostname

Banner is whatever information a remote connection gives you when you connect. For ssh that will be some information about the server, version of ssh, hostname, and (hopefully) a prompt to login, or a request for a key. For http, it will be a handful of headers about the server. Tools like Shodan scan the internet looking for active connections, and try to banner-grab on common ports, looking for details like server versions, operating system versions, etc for a long list of protocols like telnet, http, ssh, smtp, vnc, remote desktop (often with screenshots of the remote system, disturbing often unauthenticated straight to the desktop or running program), etc. If you're of a malicious mindset, when a new vulnerability is discovered, or an old one, you can look up a list of vulnerable systems from the database, searching by service and version, rather than scanning the internet yourself.