One thing the author may have missed here because I didn’t see it mentioned: this also misses any servers not hosted on the default port of 25565. I don’t know how common this really is, but Minecraft has SRV record support, and for those of us running more than one Minecraft server on a single box it’s likely at least one will be on a different port.
I'm in roughly the same boat as you (minus the multiple instances). My personal Minecraft server I run on a machine sitting behind me at home for friends uses SRV records. I bump the port number each "major" version release (yeah, I know, "minor" version in semver semantics) in case I ever have to run a previous version for whatever reason. This gets reflected in the SRV records. I've never actually had a reason to do this, but it's there if I need to.
Or at least that's the theory. I haven't updated it for 1.18. Not sure I will unless I run Tekkit or something in the future.
He’s scanning IP addresses, not dns names, so there’s no easy way to get SRV records. He could first do a reverse DNS lookup, but that would slow things down tremendously and also there are many, many Minecraft servers running without DNS names
His point is that because of SRV record, using the default port is not needed, thus it's make it more likely that a server wouldn't mind being on another port.
That won’t get them all either, and likewise will only find one server per IP. The only really reliable way would be to scan every port to see if there’s a Minecraft server there, but that blows up the search space by quite a bit.
