ZMap: Single packet network scanner designed for Internet-wide network surveys

zmap.io

63 points·dedalus··8 comments

Thread from 2013: https://news.ycombinator.com/item?id=6226105

I used it a bit when it first came out but I've since observed masscan is more popular. I am curious whether or not they both perform similar scans.

Internet wide scans with zmap/zgrab are published (to researchers) by Censys.io

Is there a publicly available "do-not-scan" host list (govt, etc)?

I've seen a few lists like this [0] floating around.

I'll warn you that even with a list, depending on which ports you scan you're still likely to get abuse complaints. Also port scanning can max out networking bandwidth, and most hosts aren't too keen on either.

[0] https://github.com/zmappingborg/blacklists/blob/master/black...

Regarding the bandwidth, your own connection is going to be the upper bound: "If ZMap simply probed every IPv4 address in numerical order, it would risk overloading destination networks with scan traffic and produce inconsistent results in the case of a distant transient network failure. To avoid this, ZMap scans addresses according to a random permutation of the address space."

https://zmap.io/paper.pdf

That's what I mean, your host may be upset if you're maxing out a shared line.

> Is there a publicly available "do-not-scan" host list (govt, etc)?

Sounds like a great way to broadcast your box is interesting.

Sometimes obscurity is a good thing.

Reply on news.ycombinator.com