zmap(1)

NAME
zmap - A fast Internet-wide scanner

SYNOPSIS
zmap [ OPTIONS ... ]

DESCRIPTION
ZMap is a network tool for scanning the entire Internet (or large samples).

OPTIONS

  Basic options

-p, --target-port=port
    TCP port number to scan (for SYN scans)

-o, --output-file=name
    When using an output module that uses a file (such as the default), write results to this file. Use - for stdout.

-b, --blacklist-file=path
    File of subnets to exclude, in CIDR notation (e.g. 192.168.0.0/16), one-per line. It is recommended you use this to exclude RFC 1918 addresses, multicast, IANA reserved space, and other IANA special-purpose addresses. An example blacklist file is provided in conf/blacklist.conf for this purpose.

-w, --whitelist-file=path
    File of subnets to constrain scan to, in CIDR notation, e.g. 192.168.0.0/16

  Scan options

-n, --max-targets=n
    Cap number of targets to probe (as a number or a percentage of the address space)

-N, --max-results=n
    Cap number of results to return

-t, --max-runtime=secs
    Cap length of time for sending packets

-r, --rate=pps
    Set send rate in packets/sec

-B, --bandwidth=bps
    Set send rate in bits/second (supports suffixes G, M and K). This overrides the --rate flag.

-c, --cooldown-time=secs
    How long to continue receiving after sending last probe (default=8)

-e, --seed=n
    Seed used to select address permutation. Specify the same seed in order to scan the same sample repeatedly.

-T, --sender-threads=n
    Threads used to send packets (default=1)

-P, --probes=n
    Number of probes to send to each IP (default=1)

-d, --dryrun
    Print out each packet to stdout instead of sending it. (May be useful for debugging.)

  Network options

-s, --source-port=port|range
    Source port(s) for scan packets

-S, --source-ip=ip|range
    Source address(es) for scan packets

-G, --gateway-mac=addr
    Specify gateway MAC address. All packets will be sent to this Ethernet address.

-i, --interface=name
    Specify network interface to use.

-X, --vpn
    If using ZMap through a VPN, use this option. Instead of sending raw Ethernet frames, ZMap will send IP packets. When using this option, it is generally also necessary to provide the interface (through the -i flag).

  Advanced options

-M, --probe-module=name
    Select probe module (default=tcp_synscan)

-O, --output-module=name
    Select output module (default=simple_file)

-f, --output-fields=fields
    Fields that should be output in result set; see --list-output-fields

--probe-args=args
    Arguments to pass to probe module

--output-args=args
    Arguments to pass to output module

--list-output-modules
    List available output modules

--list-probe-modules
    List available probe modules

--list-output-fields
    List all fields that can be output (using --output-fields ) by selected probe module

  Additional options

-C, --config=filename
    Read a configuration file, which can specify any of these options (default=/etc/zmap/zmap.conf)

-q, --quiet
    Do not print status updates

-g, --summary
    Print configuration and summary at end of scan

-v, --verbosity=n
    Level of log detail (0-5) (default=3)

-h, --help
    Print help and exit

-V, --version
    Print version and exit

EXAMPLES
Scan the whole Internet for hosts with port 443 open (results discarded):

zmap -p 443

Find 5 HTTP servers (port 80), scanning at 10 Mb/s, print the results to stdout:

zmap -N 5 -B 10M -p 80 -o -

WARNING
By default, ZMap attempts to scan at the line speed of your Ethernet interface and can easily use 1 Gbit/second of bandwidth. If your network is not able to support sending packets this quickly, your local network may become congested, causing connectivity problems for you and those around you. Use the -B (--bandwidth) option to set ZMap's maximum bandwidth to an appropriate limit for your network and upstream connection.

AUTHOR
Zakir Durumeric, Eric Wustrow, J. Alex Halderman (https://www.zmap.io)