---
updatedAt: 2025-12-30T16:26:19.000Z
agentTools:
  projectIndex: https://docs.censys.com/llms.txt
---

# Ports & Protocols

In Censys Attack Surface Management (ASM), the <Anchor label="Ports & Protocols dashboard" target="_blank" href="https://app.censys.io/dashboard?id=ports-protocols-dashboard">Ports & Protocols dashboard</Anchor> enables you to understand exactly which ports are open in your attack surface across the full 65,535-port range. This allows you to quickly determine whether there are any open ports that are misconfigured or non-compliant with your organization’s policy.

In addition to ports, the dashboard shows which protocols are present on your ports. ASM identifies whether these protocols are on standard ports, [as defined by IANA](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml). Nonstandard port and protocol combinations may indicate misconfigurations or malicious behavior. By closing these gaps, you can reduce your attack surface and, in turn, reduce the chances of a breach.

[Learn more about how Censys scanning works and how it helps protect your organization here](https://docs.censys.com/docs/internet-scanning#/predictive-scanning-use-cases).

## View and filter the dashboard

In the ASM web UI, on the main dashboard page, click [**Ports & Protocols**](https://app.censys.io/dashboard?id=ports-protocols-dashboard).

Filter the entire dashboard using the standard and nonstandard toggle and the options available in the **Severity**, **Associated Date**, **Tags** or **Protocols** dropdown menus. Use the **Min Port:** and **Max Port:** fields to define a range of ports to focus on.

> 📘 Note
>
> Unknown protocols are categorized as running on nonstandard ports by default.

<Image align="center" className="border" border={true} src="https://files.readme.io/6429c4ced770252d38170c76cc8fe7b1d4332951c06d4ccc75022a79dfd9701a-ports_and_protocols_main_filtering_2.gif" />

### Port number distribution

The port distribution chart is a visualization of all open ports in your attack surface.

<Image align="center" className="border" border={true} src="https://files.readme.io/a60e6ffcdd9404568c7e42cef31a981ad82227ad25ec3dad9079a6eefbb8d1c1-port_number_dist.png" />

Hover over a dot to view its port number and protocol information. Click the dot to see all assets in your Inventory associated with the port and protocol pair. The query syntax used for this query is shown in the query bar. Set up regular alerting and tagging for these assets with [Saved Query Automation](https://docs.censys.com/docs/asm-build-save-automate-queries#/automate-saved-queries).

<Image align="center" className="border" border={true} src="https://files.readme.io/7f3030338c32e3fa0a7c7ca83183c1df9f5fd967f071b1f6007584659beec56e-click_dot_2.gif" />

### Protocol discovery

The protocol discovery chart shows the count of your services running various protocols. The green component of the bar represents services running on standard ports, while the orange component represents nonstandard ports. Use the **Next 10 >** and **< Previous 10** links to page through your protocols.

<Image align="center" className="border" border={true} src="https://files.readme.io/2d77b5211205a2304d03b6e8f8957cd8ef3e08a13f29fb11884fc7c3951c4848-prot_1.png" />

Select a protocol bar plot to see standard and nonstandard port information for that protocol. This will also filter the port number distribution chart above.

Click any of the linked port numbers to see all assets in your Inventory associated with that port and protocol pair. The query syntax used for this query is shown in the query bar. Use [Saved Query Automation](https://docs.censys.com/docs/asm-build-save-automate-queries#/automate-saved-queries) to set up regular alerting and tagging for these assets.

<Image align="center" className="border" border={true} src="https://files.readme.io/f7806d873fa37a5e9206f40966b495f7992bf006604d3ef50c4eeb6e6018971e-prot_3.gif" />

### Use cases

* Compliance standards including NIST SP 800 and PCI 4.0 require the closure of unnecessary ports and protocols. Use the dashboard to identify assets to investigate and remediate to align with these standards.
* Use the Severity filter on the dashboard to quickly identify nonstandard ports being used by assets with risks. In general, a misconfigured port is worthy of investigation, while a misconfigured port with a risk should be immediately remediated.
* Attackers use nonstandard ports to evade detection, for example during C2 communication. If your environment has already been infiltrated, [activity on a nonstandard port](https://attack.mitre.org/techniques/T1571/) can indicate a compromise and will need to be remediated.