Nice work. There are a lot of claims out there about this sort of thing, and not a lot of hard data. If you had used a port other than 24 you would have seen

Nice work. There are a lot of claims out there about this sort of thing, and not a lot of hard data. If you had used a port other than 24 you would have seen 0 attempts. Port 24 is still scanned fairly frequently, something like 22X where X !=2 is almost never scanned. If you block port 22 and use iptables to redirect a random high port to port 22, you'll never see any connection attempts - unless someone is really targeting you. I did a bunch of reporting/math against our data a few months ago the last times this came up on reddit. I found a few interesting things and tried to counter some bogus claims. First bogus claim: Shodan scans everything, so you can't hide. I checked for the entire month of feburary for a large address space, shodan scanned these ports: 0 3 7 11 13 15 17 19 21 22 23 25 26 37 49 53 67 69 70 79 80 81 82 83 84 88 102 110 111 119 123 129 137 143 161 175 179 195 311 389 443 444 445 465 500 502 503 504 515 520 523 554 587 623 626 631 666 771 789 873 902 992 993 995 1010 1023 1025 1099 1177 1200 1234 1311 1434 1471 1604 1723 1777 1883 1900 1911 1962 1991 2000 2067 2082 2083 2086 2087 2123 2152 2181 2222 2323 2332 2375 2376 2404 2455 2480 2628 3000 3128 3306 3386 3388 3389 3460 3541 3542 3689 3749 3780 3784 3790 4000 4022 4040 4063 4064 4369 4443 4444 4500 4567 4848 4911 4949 5000 5001 5006 5007 5008 5009 5060 5094 5222 5269 5353 5357 5432 5555 5560 5577 5632 5672 5800 5900 5901 5984 5985 5986 6000 6379 6664 6666 6667 6881 6969 7071 7218 7474 7547 7548 7657 7777 7779 8000 8010 8060 8069 8080 8081 8086 8087 8089 8090 8098 8099 8112 8139 8140 8181 8333 8334 8443 8554 8649 8834 8880 8888 8889 9000 9001 9002 9051 9080 9100 9151 9160 9191 9200 9443 9595 9600 9943 9944 9981 9999 10000 10001 10243 11211 12345 13579 14147 16010 17000 18245 20000 20547 21025 21379 23023 23424 25105 25565 27015 27017 28017 30718 32400 32764 37777 44818 47808 49152 49153 50070 50100 51106 55553 55554 62078 64738 2nd bogus claim: "A single host on a decent connection will be able to scan all ports on a /16 in less then an hour. I see scans like this all the time." It is the same amount of work to scan every ipv4 address on port 22 as it is to scan every port on a /16. Every port on a /16 is 2^32 (65536 ports on 65536 hosts) or 4294967296 ports. Saying it can be done on a "decent" connection in less than an hour, at 4294967296 ports in 3600 seconds works out to 1,193,046 packets/second. Line rate gigE maxes out at 1,488,095 pps. You would need to saturate a full gigabit for an hour to fully scan a /16 - and a full gigabit at whatever site you are scanning. with 0% packet loss. 3rd bogus claim: (re port knocking) Faster internet speeds means more scanning power which means that it gets easier to find your hidden service If I am using a non cryptographic port knocking daemon with a 4 port knocking sequence, that has 65536^4 combinations. One should probably figure out what the length of the shorter De Bruijn sequence is for guessing 4 port sequences, which I believe just works out to around "only" 65536^4 packets instead of 4 times that. Also assuming the correct sequence would be found halfway through, that would mean 9223372036854775808 packets required to be sent. At line rate gigE, that would take 6198107000463 seconds, or 196,540 years. Only 19,654 years at line rate 10gig though!