Shodan for Network Engineers: Real OSINT Workflows

Your network has a public attack surface. Shodan already scanned it. The question is whether you checked before someone else did.

Shodan indexes internet-connected devices, not web pages. It crawls open ports and stores the raw banner each device returns. That includes routers, firewalls, VPN concentrators, IoT sensors, and databases your team forgot were exposed. This guide covers practical Shodan workflows built for defensive network engineering: finding your own exposure, auditing your ASN, and catching shadow IT before an attacker does.

Table of Contents

1. What Shodan Actually Indexes
2. Step 1: Set Up Your Account and API Access
3. Core Search Filters Every Engineer Needs
4. Workflow 1: Audit Your Own ASN
5. Workflow 2: Find Shadow IT and Forgotten Assets
6. Workflow 3: Check for Exposed Management Interfaces
7. Workflow 4: Investigate a Suspicious IP from Your Logs
8. Automate Checks with the Shodan CLI and API
9. Set Up Continuous Monitoring
10. Responsible Use and Legal Boundaries
11. Quick Reference Checklist
12. Conclusion

What Shodan Actually Indexes

Shodan probes IP addresses on common ports and records what each service sends back. This banner data includes:

• Open ports and the service running on each one
• Software name and version, when the banner reveals it
• SSL/TLS certificate details, including the organization name and expiry date
• Geolocation and ASN ownership
• HTTP headers, page titles, and default login pages
• Historical snapshots, so you can see when a service first appeared online

Shodan does not scan your internal network. It only sees what already faces the public internet. That distinction matters: anything Shodan finds, an external attacker can find too.

Step 1: Set Up Your Account and API Access

1. Create a free account at shodan.io.
2. Grab your API key from the account page.
3. Install the command-line client:

pip install shodan
shodan init YOUR_API_KEY

The free tier limits query volume and hides some filters. A paid membership unlocks full filter access, more results per query, and export tools. For a single organization’s ASN, the free tier usually covers a monthly audit.

Core Search Filters Every Engineer Needs

Shodan search syntax combines keywords with filters. Learn these first:

• net: — search a specific IP range, e.g. net:203.0.113.0/24
• org: — search by organization name, e.g. org:"Acme Corp"
• hostname: — search by domain, e.g. hostname:acme.com
• port: — filter by port number, e.g. port:3389
• product: — filter by identified software, e.g. product:nginx
• country: — filter by two-letter country code, e.g. country:US
• city: — filter by city name
• ssl: — search SSL certificate data, e.g. ssl:"Acme Corp"
• vuln: — filter by CVE identifier, available on paid plans, e.g. vuln:CVE-2021-44228
• before: and after: — limit results by scan date, e.g. after:01/01/2026
• has_screenshot:true — show only results with a captured screenshot

Combine filters with spaces. Shodan treats each filter as an AND condition:

net:203.0.113.0/24 port:3389
org:"Acme Corp" product:MongoDB
hostname:acme.com port:22,23,3389

Workflow 1: Audit Your Own ASN

Run this workflow monthly to see your full external footprint:

1. Find your ASN. Use a WHOIS lookup or bgp.he.net to get your organization’s ASN number.
2. Query Shodan by ASN:

   asn:AS12345

3. Review every result against your asset inventory. Flag anything not in your CMDB.
4. Check open management ports across the same range:

   asn:AS12345 port:22,23,3389,5900

5. Export the results for the audit record:

   shodan download acme-audit asn:AS12345
   shodan parse --fields ip_str,port,org acme-audit.json.gz

Workflow 2: Find Shadow IT and Forgotten Assets

Shadow IT slips past standard scans because it lives outside the known asset list. Shodan finds it anyway, since Shodan scans by IP and hostname, not by your inventory.

1. Search every subdomain against Shodan’s hostname filter:

   hostname:acme.com

2. Cross-reference results against your DNS records and CMDB.
3. Flag any IP or hostname that resolves to infrastructure your team does not recognize.
4. Check the banner and certificate for a deployment date or team name that identifies the owner.

Real-world pattern: A staging subdomain like staging-api.acme.com points to a cloud instance running an unpatched service, deployed months ago for testing and never decommissioned. Standard vulnerability scans miss it because it was never added to the scan target list. Shodan finds it because it only needs a public IP and an open port.

Workflow 3: Check for Exposed Management Interfaces

Management interfaces are the highest-value find in any external audit. Run these queries against your own IP ranges:

• net:YOUR.RANGE port:3389 — exposed RDP
• net:YOUR.RANGE port:22 — exposed SSH
• net:YOUR.RANGE port:23 — exposed Telnet, which never belongs on a public interface
• net:YOUR.RANGE port:161 — exposed SNMP
• net:YOUR.RANGE port:8291 — exposed MikroTik Winbox
• net:YOUR.RANGE product:"MikroTik RouterOS" — every MikroTik device Shodan sees on your range
• net:YOUR.RANGE http.title:"login" — any web login page facing the public internet

Every result on this list needs one of two outcomes: move it behind a VPN or restrict it with a firewall filter. A management interface should never sit open on the public internet.

MikroTik example: lock down Winbox and API access

If Shodan finds an exposed MikroTik management port, fix it at the router:

/ip firewall filter
add chain=input protocol=tcp dst-port=8291 src-address-list=!trusted action=drop comment="Block Winbox from untrusted sources"
add chain=input protocol=tcp dst-port=22 src-address-list=!trusted action=drop comment="Block SSH from untrusted sources"

/ip firewall address-list
add list=trusted address=203.0.113.10/32 comment="Admin workstation"

Re-run the Shodan query after the change and confirm the port no longer answers on the next scan cycle.

Workflow 4: Investigate a Suspicious IP from Your Logs

Use Shodan to add context to an IP address you found in a firewall log or IDS alert:

1. Search the IP directly:

   shodan host 198.51.100.20

2. Review the returned open ports, banners, and organization name.
3. Check the historical data to see when the IP first appeared with this configuration.
4. Cross-reference the IP with a reputation source such as AbuseIPDB or GreyNoise. Shodan tells you what is exposed; a reputation source tells you if the IP is a known scanner or attacker.
5. Document the IP, the query used, and the timestamp for your incident record.

Automate Checks with the Shodan CLI and API

Manual searches work for one-off checks. Recurring audits need automation. The Shodan Python library makes this simple:

import shodan

api = shodan.Shodan("YOUR_API_KEY")

results = api.search("asn:AS12345 port:3389")

for result in results['matches']:
    print(result['ip_str'], result['port'], result.get('org', 'unknown'))

Schedule this script with cron to run weekly and email the output to your security team:

0 6 * * 1 /usr/bin/python3 /opt/scripts/shodan_audit.py | mail -s "Weekly Shodan Audit" secteam@acme.com

Set Up Continuous Monitoring

Shodan Monitor tracks a defined IP range and alerts on new findings automatically:

1. Log in to shodan.io and open the Monitor dashboard.
2. Add your ASN or IP ranges to the monitored list.
3. Configure triggers for new open ports, new vulnerabilities, or new certificates.
4. Connect the alert output to email, Slack, or a SIEM webhook.

Continuous monitoring closes the gap between a monthly manual audit and a real-time exposure. A new open port shows up in the alert feed within one scan cycle, not thirty days later.

Responsible Use and Legal Boundaries

• Only search your own infrastructure or infrastructure you have written authorization to assess.
• Shodan returns passive scan data. It does not grant you access to any system it finds.
• Never attempt to log in to, exploit, or alter a system you discover, even one that appears misconfigured.
• Report exposed third-party systems through responsible disclosure channels, not by accessing them.
• Keep a record of every query and finding for audit and legal purposes.

Quick Reference Checklist

• Confirm your ASN and IP ranges before you start
• Run asn: and net: searches against your own range
• Check every result against your CMDB
• Search management ports specifically: 22, 23, 3389, 161, 8291, 5900
• Flag Telnet and any unauthenticated database port as a critical finding
• Cross-reference suspicious IPs with a reputation source
• Automate recurring checks with the Shodan CLI or API
• Set up Shodan Monitor for continuous alerting
• Document every finding with a timestamp

Conclusion

Shodan shows you the network the way an outside attacker sees it. Run the ASN audit first. Chase every open management port second. Automate the recurring check so exposure gets caught in days, not months. The forgotten staging server and the exposed router are already indexed. Find them before someone else does.