ZMap – The Internet Scanner

ZMap is an open source single packet network scanner designed for Internet-wide network surveys.

On a typical desktop computer with a gigabit Ethernet connection, ZMap is capable scanning the entire public IPv4 address space in under 45 minutes. With a 10gigE connection and PF_RING, ZMap can scan the IPv4 address space in under 5 minutes.

It operates on GNU/Linux, Mac OS, and BSD. It currently has fully implemented probe modules for TCP SYN scans, ICMP, DNS queries, UPnP, BACNET, and can send a large number of UDP probes.

Since ZMap is designed to perform comprehensive scans of the IPv4 address space, when you are running ZMap, please keep in mind that you are potentially scanning the ENTIRE IPv4 address space at over 1.4 million packets per second. So, before performing even small scans, you should contact the local network administrators and also follow the best practices.

Best Practices:

• Coordinate closely with local network administrators to reduce risks and handle inquiries
• Verify that scans will not overwhelm the local network or upstream provider
• Signal the benign nature of the scans in web pages and DNS entries of the source addresses
• Clearly explain the purpose and scope of the scans in all communications
• Provide a simple means of opting out and honor requests promptly
• Conduct scans no larger or more frequent than is necessary for research objectives
• Spread scan traffic over time or source addresses when feasible