zmap (1)

---

NAME

zmap - A fast Internet-wide scanner

SYNOPSIS

zmap [ OPTIONS ... ]

DESCRIPTION

ZMap is a network tool for scanning the entire Internet (or large samples).

OPTIONS

Basic options

-p, --target-port=port

TCP port number to scan (for SYN scans)

-o, --output-file=name

When using an output module that uses a file (such as the default), write results to this file. Use - for stdout.

-b, --blacklist-file=path

File of subnets to exclude, in CIDR notation (e.g. 192.168.0.0/16), one-per line. It is recommended you use this to exclude RFC 1918 addresses, multicast, IANA reserved space, and other IANA special-purpose addresses. An example blacklist file is provided in conf/blacklist.conf for this purpose.

-w, --whitelist-file=path

File of subnets to constrain scan to, in CIDR notation, e.g. 192.168.0.0/16

Scan options

-n, --max-targets=n

Cap number of targets to probe (as a number or a percentage of the address space)

-N, --max-results=n

Cap number of results to return

-t, --max-runtime=secs

Cap length of time for sending packets

-r, --rate=pps

Set send rate in packets/sec

-B, --bandwidth=bps

Set send rate in bits/second (supports suffixes G, M and K). This overrides the --rate flag.

-c, --cooldown-time=secs

How long to continue receiving after sending last probe (default=8)

-e, --seed=n

Seed used to select address permutation. Specify the same seed in order to scan the same sample repeatedly.

-T, --sender-threads=n

Threads used to send packets (default=1)

-P, --probes=n

Number of probes to send to each IP (default=1)

-d, --dryrun

Print out each packet to stdout instead of sending it. (May be useful for debugging.)

Network options

-s, --source-port=port|range

Source port(s) for scan packets

-S, --source-ip=ip|range

Source address(es) for scan packets

-G, --gateway-mac=addr

Specify gateway MAC address. All packets will be sent to this Ethernet address.

-i, --interface=name

Specify network interface to use.

-X, --vpn

If using ZMap through a VPN, use this option. Instead of sending raw Ethernet frames, ZMap will send IP packets. When using this option, it is generally also necessary to provide the interface (through the -i flag).

Advanced options

-M, --probe-module=name

Select probe module (default=tcp_synscan)

-O, --output-module=name

Select output module (default=simple_file)

-f, --output-fields=fields

Fields that should be output in result set; see --list-output-fields

--probe-args=args

Arguments to pass to probe module

--output-args=args

Arguments to pass to output module

--list-output-modules

List available output modules

--list-probe-modules

List available probe modules

--list-output-fields

List all fields that can be output (using --output-fields ) by selected probe module

Additional options

-C, --config=filename

Read a configuration file, which can specify any of these options (default=/etc/zmap/zmap.conf)

-q, --quiet

Do not print status updates

-g, --summary

Print configuration and summary at end of scan

-v, --verbosity=n

Level of log detail (0-5) (default=3)

-h, --help

Print help and exit

-V, --version

Print version and exit

EXAMPLES

Scan the whole Internet for hosts with port 443 open (results discarded):

zmap -p 443

Find 5 HTTP servers (port 80), scanning at 10 Mb/s, print the results to stdout:

zmap -N 5 -B 10M -p 80 -o -

WARNING

By default, ZMap attempts to scan at the line speed of your Ethernet interface and can easily use 1 Gbit/second of bandwidth. If your network is not able to support sending packets this quickly, your local network may become congested, causing connectivity problems for you and those around you. Use the -B (--bandwidth) option to set ZMap's maximum bandwidth to an appropriate limit for your network and upstream connection.

AUTHOR

Zakir Durumeric, Eric Wustrow, J. Alex Halderman (https://www.zmap.io)

---