Masscan: The entire internet in 3 minutes

According to [1] they got 58 abuse complaints for a scan of the entire internet on port 22. The scanner IP address they list is hosted by cari.net who will presumably overlook some abuse reports if you're on their $225-a-month high bandwidth plan.

[1] http://blog.erratasec.com/2013/09/we-scanned-internet-for-po...

I can confirm that you will generate abuse reports for any port, including 80 and 443.

First of all, we avoid well-know "darknet" monitors that generate a lot of abuse reports.

Second of all, we response personally to each abuse report and offer to include them in our "exclude" file so that we won't scan them ever again. Though, of course, I prefer they add us to a "whitelist" file: not opening their firewall, but adding us a file that ignore logging.

That article still gives a biased answer! Floating point numbers have limited precision, too. http://channel9.msdn.com/Events/GoingNative/2013/rand-Consid...

I'm not using % on the result of rand().

I'm using the "Feistal network" construction that is at the heart of the data encryption standard, replacing binary operations like 'xor' with the "addition plus modulus" operation.

My found function sucks, and I only do 3 rounds, so there's probably some issues there. But, if I were to fix those issues, then there should be no more detectable bias than in the original DES cipher.

Ten times the temporal resolution, if you're willing/able to do it.

It's 3 minutes per port. In the real world, you'll want to scan for many ports at a time. If scanning for all ports, it'd take 108 days at this rate.