BSides LV 2024: What Do We Learn When We Scan the Internet Every Hour?

One of two talks by Censys staff at BSides Las Vegas 2024! The abstract:

They say everything on the Internet is forever, and while this may be true of your pictures from dinner last night, the reality is that everything on the Internet is NOT forever. In fact, much of the Internet is ephemeral, or flappy; services and hosts will appear online, only to disappear shortly after. This has major implications for research that utilizes Internet scanning and begs the question – how often should we be scanning the Internet, and how does this ephemerality differ across the Internet? In this talk, I’ll discuss our findings from scanning the Internet every hour for a week. I’ll share some interesting anecdotes about where uptime differed across three main variables: L4 ports, L7 services, and ASNs. I’ll dive into examples where the portion of the Internet was fairly stable (e.g. popular protocols on their standard ports) and where uptime was, well, ephemeral (e.g. TCP SIP, HTTP on non-standard ports). I’ll discuss what these findings mean for the Internet Scanning community as a whole, implications for scanning research, and next steps. My hope is that attendees leave understanding just how ephemeral the Internet is, and what they should do about it.