Open CharGen Report

LAST UPDATED: 2023-02-06

This report identifies hosts that have the CharGen service running and accessible on the Internet.

These services have the potential to be used in amplification attacks by criminals that wish to perform denial of service attacks.

The service is tested by sending a UDP packet containing a single carriage return to UDP port 19.

For more details behind the scan methodology and a daily update of global Chargen scan statistics please visit our dedicated Chargen scan page.

For more information on our scanning efforts, check out our Internet scanning summary page.

Filename(s): scan_chargen

Fields

  • timestamp
    Time that the IP was probed in UTC+0
  • ip
    The IP address of the device in question
  • protocol
    Protocol that the DNS response came on (usually UDP)
  • port
    Port that the CharGen response came from
  • hostname
    Reverse DNS name of the device in question
  • tag
    Will always be chargen
  • size
    The size of the response that was received (in bytes)
  • asn
    ASN of where the device in question resides
  • geo
    Country where the device in question resides
  • region
    State / Province / Administrative region where the device in question resides
  • city
    City in which the device in question resides
  • response_size
    Response size in bytes
  • amplification
    Describes the amplification factor

Sample

"timestamp","ip","protocol","port","hostname","tag","size","asn","geo","region","city","naics","sic","sector","response_size","amplification"
"2010-02-10 00:00:00",192.168.0.1,udp,19,node01.example.com,chargen,,64512,ZZ,Region,City,0,0,,74,74.00
"2010-02-10 00:00:01",192.168.0.2,udp,19,node02.example.com,chargen,,64512,ZZ,Region,City,0,0,,74,74.00
"2010-02-10 00:00:02",192.168.0.3,udp,19,node03.example.com,chargen,,64512,ZZ,Region,City,0,0,Government,74,74.00

Our 118 Report Types

« Back to Network Reporting