ZMap High-Speed Internet Scanner

ZMap is a free and open-source network scanning tool designed for performing fast, stateless Internet-wide network scans. Developed by researchers at the University of Michigan (Zakir Durumeric, Eric Wustrow, and J. Alex Halderman) and first published in 2013 at the USENIX Security Symposium, ZMap is designed to scan the entire IPv4 address space (approximately 4 billion addresses) in under 45 minutes on a single server with a gigabit connection, compared to Nmap which would take months for the same scan. Key features: stateless scanning: unlike traditional scanners (Nmap) that maintain per-target state (connection tables, sequence numbers), ZMap is completely stateless. It sends probe packets without tracking individual targets, relying on a stateless receiver to identify responses. This architecture eliminates memory limitations and enables massive-scale scanning. Stateless TCP SYN scanning: ZMap sends TCP SYN packets to a target port and identifies hosts that respond with SYN-ACK (open port) or RST (closed port), without completing the TCP handshake. Probe modules: pluggable probe modules for different protocols including TCP SYN scan, ICMP echo scan, UDP scan (for specific services like DNS, NTP, SNMP), and custom modules. Stateless rate limiting: precise bandwidth and packet rate control. Performance: designed for single-machine scanning at line rate (10 Gbps+ on 10GbE connections). ZMap can scan all 4 billion IPv4 addresses for a single port in 45 minutes at 10Gbps or 5 hours at 1Gbps. Randomization: built-in pseudorandom address permutation ensures that consecutive targets are spread across the IP space, avoiding hammering a single network. Blocklists: built-in IP blocklist (allow/deny lists) to avoid scanning military, government, and RFC 1918 private addresses. Output formats: CSV, JSON, Redis, MongoDB. Used by security researchers at Censys, Shadowserver, and academic institutions for Internet-wide security studies. Apache-2.0.