Censys Internet Scanning Intro

How and What Does Censys Scan?

Censys continually scans the public IPv4 address space on 2,535 ports using automatic protocol detection.

On ports with IANA-assigned protocols, Censys attempts to complete a handshake with the assigned protocol (e.g., Telnet on TCP/23). If that fails, we try additional handshakes according to our experience with protocol and port pairings. On ports without an assigned service, we start by sending an HTTP request.

Censys analyzes a server’s response—even if it’s using an unexpected protocol—to identify the service running there.

For example, if an HTTP request results in an SSH banner, Censys will close the HTTP connection and reattempt an SSH handshake. Most protocols that run on unassigned ports send data when we connect or are identifiable based on their response to an HTTP request or TLS handshake, which allows us to uncover the vast majority of services in unexpected places. See Services Censys Detects and Ports Censys Scans for details.

Censys never attempts to log into any service, read any database, or otherwise gain authenticated access to any system. The only HTTP method Censys uses is GET; we never POST data to any server.

How Often Does Censys Scan For New Services?

Discovery means finding a service on an IP/port that was not there last time we looked. Censys has several schedules for discovery based on our knowledge of the Internet:

1. Global Scan of Popular Ports. We scan the whole IPv4 space on 131 ports with IANA-assigned services every day. 
2. Global Scan of Less Popular Ports. We scan the whole IPv4 space on 2,198 additional ports on a regular basis, completing a walk every 10 days.
3. Cloud Provider Scans. Since many cloud hosts are ephemeral, we scan the 1,440 most popular ports on Amazon, Google, and Azure hosts every day.

How Often Does Censys Refresh Service Data?

Once a service has been discovered, Censys prioritizes refreshing the information about that service to ensure it is accurate and up to date.

Once a day, the age of each known service (~600M) is checked. Any service with an observation time stamp older than 24 hours is rescanned. With this process, the average age of high-value service data is about 16 hours!

What Protocols (Services) Does Censys Scan?

Censys detects 38 Layer 7 protocols. The default Layer 4 protocol is TCP, although a few protocols, such as DNS, are scanned with UDP.

In addition, we perform other HTTP(S) handshakes to identify specific HTTP applications (e.g., Kubernetes and Elasticsearch). Service names present the most specific information we have. For example, a generic HTTP service has a service name of HTTP, but an HTTP service that’s actually an Elasticsearch server has a service name of ELASTICSEARCH.

HTTP + HTTPS

On ports running HTTP(S), we request the root (/) page and follow local HTTP redirects. We’re able to detect HTTP + HTTPS on any port. In addition, we perform follow-up requests to identify the following applications:

• CWMP
• Elasticsearch
• Kubernetes 
• Prometheus

Databases 

We check for popular database servers on their assigned ports. We never attempt to authenticate against databases or read any user databases.

• Elasticsearch
• Memcached
• MongoDB
• Microsoft SQL Server (MSSQL)
• MySQL
• Oracle
• PostgreSQL
• Redis

Core Internet Protocols

• DNS Open Resolvers
• ECHO
• NTP
• IPP

Message Brokers

On ports running message broker protocols, we complete an initial protocol-specific handshake, with no attempt to authenticate. For (MQTT) services not requiring authentication that are broadcasting messages, we may collect a sample of these messages.

• AMQP
• COAP
• MQTT

Remote Access Protocols

We check for the following remote access protocols. We can detect RDP, SSH, and Telnet on any port.

• OpenVPN 
• PC Anywhere
• RDP
• SSH
• Telnet
• VNC
• X11

Mail and VoIP Protocols

On ports running common mail and VoIP protocols, banner data is collected and a STARTTLS handshake is completed if the server indicates support.

• POP3(S)
• IMAP(S)
• SMTP(S)
• SIP(S)

Network Administration Protocols

On ports running network administration protocols, we complete an initial protocol-specific handshake, with no attempt to authenticate.

• IPMI
• SNMP

File-Sharing Protocols

On ports running file-sharing protocols, we complete an initial protocol-specific handshake, with no attempt to authenticate. We can detect FTP on any port.

• FTP(S)
• SMB

Industrial Control (SCADA) Protocols

On ports running industrial control protocols, we complete an initial protocol-specific handshake, with no attempt to authenticate.

• BACnet
• DNP3
• Tridium Fox
• MODBUS
• Siemens S7

Ports Scanned

Censys scans the following ports.