ZMap: Fast Internet-wide Scanning and Its Security Applications
ZMap: Fast Internet-wide Scanning and Its Security Applications
复制标题
DOI：
--
复制
发表时间：
2013-08
期刊：
影响因子：
--
通讯作者：
Zakir Durumeric;Eric Wustrow;J. A. Halderman
中科院分区：
文献类型：
--
作者：
Zakir Durumeric;Eric Wustrow;J. A. Halderman
互联网范围内的网络扫描有许多安全应用，包括暴露新的漏洞和跟踪防御机制的采用，但使用现有工具探测整个公共地址空间既困难又缓慢。我们介绍了ZMap，这是一款模块化的开源网络扫描仪，专为执行互联网范围的扫描而设计，能够在不到45分钟的时间内从单台机器的用户空间测量整个IPv4地址空间，接近千兆以太网的理论最大速度。我们介绍了扫描仪的体系结构，对其性能和准确性进行了实验表征，并探索了攻击性和防御性的高速互联网规模网络调查的安全含义。我们还讨论了在进行互联网范围的调查时良好的互联网公民的最佳做法，这得益于我们过去一年进行长期研究调查的经验。
Internet-wide network scanning has numerous security applications, including exposing new vulnerabilities and tracking the adoption of defensive mechanisms, but probing the entire public address space with existing tools is both difficult and slow. We introduce ZMap, a modular, open-source network scanner specifically architected to perform Internet-wide scans and capable of surveying the entire IPv4 address space in under 45 minutes from user space on a single machine, approaching the theoretical maximum speed of gigabit Ethernet. We present the scanner architecture, experimentally characterize its performance and accuracy, and explore the security implications of high speed Internet-scale network surveys, both offensive and defensive. We also discuss best practices for good Internet citizenship when performing Internet-wide surveys, informed by our own experiences conducting a long-term research survey over the past year.