I wonder how Shodan crawls internet-connected devices and adds them to its database. I know Google, for instance, finds new websites by following links in websites it already found, but that strategy won't work with internet-connected devices because they don't link to one another.

What method does Shodan follow?

  • 2
    I dont know why people vote a question down without a comment. This question is legit and so I voted up to balance it out. Apr 21 '14 at 20:26

There are only about four billions of possible IPv4 addresses, so trying them all is feasible, with enough bandwidth. There are available tools for that.

Shodan themselves document in their FAQ that they use some custom code:

A home-grown, distributed port scanner was developed for this project.

"Distributed" here means that connections are made from several machines, which seems not an issue since Internet-wide scanning is, by definition, an embarrassingly parallel problem.

A related case is the so-called Internet Census 2012 in which some unknown people repeatedly scanned for some vulnerable hosts (typically home routers still configured to accept default admin credentials) and temporarily hijacked the said systems to enlist them in a whole Internet scan on "most common ports" -- that's a case of a self-replicating botnet. They say that they reached 420000 clients under their control. For a complete Internet scan, each client only has 10000 IP addresses to try, so this can be done quite discreetly (say, 3 probed IP per second for an hour).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.