While analyzing some hosts in the Censys Platform (Web GUI), we found that the Services section sometimes shows “HTTP [many] / TCP” instead of a specific port number.
The detailed view mentions that:
“This host has multiple services detected on various TCP ports. Displayed as ‘HTTP [many] / TCP’ to indicate a combination of identified and sampled services.”
We can identify the representative port using: "host.services.representative_info.sampled_port"
Is there a way to retrieve a list of all TCP ports on which HTTP services were detected, other than the representative sampled port?
Thanks in advance!
Best answer by MattK_Censys
Hey Kurumi, checked with the team and here are the answers to your questions.
do I understand correctly that the “Many/HTTP” label groups information from multiple ports to make it easier to identify ports that respond differently or have unique characteristics?
Yes.
For hosts shown as “Many/HTTP” in the Platform, all detected HTTP ports could previously be viewed in Censys Search. I understand that these data are now considered low-value and have been discarded. Is there any plan to make it possible to view the full list of ports for such hosts in the future?
No, not at this time.
Could you share a bit more detail on how this classification is determined? For example, is it based on the number of detected ports, the similarity of responses, or other factors?
There are several factors we use that contribute to this classification, including number of ports by protocol.
How is the representative or “sampled” port chosen when multiple HTTP ports are detected on a host? Understanding this selection logic would help us interpret the data more accurately.
The lowest number port of the representative set is "sampled" and shown.
Hi Kurumi, there is not a way to do that, no. For hosts like that, we discard the data and hope to not scan those ports in the future, as we've identified them as low value. Not showing that information is a feature and helps users see the outliers on “superhosts” instead of wading through low-value service data. I hope this helps.
Regarding your comment, “Not showing that information is a feature and helps users see the outliers on superhosts instead of wading through low-value service data”, do I understand correctly that the “Many/HTTP” label groups information from multiple ports to make it easier to identify ports that respond differently or have unique characteristics?
I’d also appreciate it if you could clarify a few additional points:
Port Information Previously Available in Search For hosts shown as “Many/HTTP” in the Platform, all detected HTTP ports could previously be viewed in Censys Search. I understand that these data are now considered low-value and have been discarded. Is there any plan to make it possible to view the full list of ports for such hosts in the future?
Criteria for Classifying “Many/HTTP” as Low-Value Could you share a bit more detail on how this classification is determined? For example, is it based on the number of detected ports, the similarity of responses, or other factors? When evaluating response similarity, which elements are compared — such as the Response Body, HTML Title, or other fields — to decide that multiple ports return the same response?
Selection of the Sampled Port How is the representative or “sampled” port chosen when multiple HTTP ports are detected on a host? Understanding this selection logic would help us interpret the data more accurately.
Thank you again for your time and for clarifying these points!
Hey Kurumi, checked with the team and here are the answers to your questions.
do I understand correctly that the “Many/HTTP” label groups information from multiple ports to make it easier to identify ports that respond differently or have unique characteristics?
Yes.
For hosts shown as “Many/HTTP” in the Platform, all detected HTTP ports could previously be viewed in Censys Search. I understand that these data are now considered low-value and have been discarded. Is there any plan to make it possible to view the full list of ports for such hosts in the future?
No, not at this time.
Could you share a bit more detail on how this classification is determined? For example, is it based on the number of detected ports, the similarity of responses, or other factors?
There are several factors we use that contribute to this classification, including number of ports by protocol.
How is the representative or “sampled” port chosen when multiple HTTP ports are detected on a host? Understanding this selection logic would help us interpret the data more accurately.
The lowest number port of the representative set is "sampled" and shown.
Thanks again for your previous response! I’d like to ask a few more questions about the classification criteria.
Actually, we’ve received some questions from users who would like to be able to retrieve all ports for hosts labeled as “Many/HTTP”, just like they could in Censys Search.
From your earlier explanation, I understand that “Many/HTTP” hosts are grouped this way because Censys considers the related data low-value, and I’m planning to explain that to users.
However, since this was possible in Search, I’d like to better understand how “low-value” is determined, so we can clearly explain the reasoning. You mentioned there are several factors contributing to this classification — could you please share a bit more detail on what those factors are? For example, does response similarity factor into this?
I think it would really help users if we can clearly explain why the data are considered low-value. Since they used to be able to see this data in Search, I think understanding why this changed could help them accept it and feel less inconvenienced. That’s why I’d like to make sure we can explain this clearly.
Hey Kurumi, the criteria that I laid out in my response on November 3 is the gist of it. There are some other circumstances in which services would be grouped in the same way, in particular for services that are part of Incapsula WAF or ZScaler.
You need a Censys account in order to create a Censys Community account. When you click the button below, you will be redirected to login using your existing Censys credentials. If you do not already have a Censys Community account, you will be prompted to create one after logging into your Censys account.
You need a Censys account in order to create a Censys Community account. When you click the button below, you will be redirected to login using your existing Censys credentials. If you do not already have a Censys Community account, you will be prompted to create one after logging into your Censys account.
