Zmap

Internet-wide port scanner capable of scanning the entire IPv4 address space in minutes

Recon & OSINT8 commands

#port#scanner#internet#network#masscan

Installation

1Install via apt

2Build from source

3Verify installation

# Debian/Ubuntu
sudo apt install zmap

# Fedora/RHEL
sudo dnf install zmap

# Build from source
git clone https://github.com/zmap/zmap.git
cd zmap
cmake . && make && sudo make install

# Verify
zmap --version

Basic Usage

Scan specific ports across large IP ranges with high throughput

# Scan port 80 on subnet
zmap -p 80 10.0.0.0/8

# Scan with output to file
zmap -p 443 192.168.0.0/16 -o results.csv

# Rate-limited scan
zmap -p 22 10.0.0.0/8 --rate=1000

# Banner grab
zmap -p 80 --banner 10.0.0.0/8

# Exclude specific IPs/subnets
zmap -p 8080 0.0.0.0/0 --exclude-file exclude.txt

# JSON output
zmap -p 443 --output-module=json 192.168.0.0/16

# Scan with custom probe module
zmap -p 443 --probe-module=tcp_syn 10.0.0.0/8

Command Reference

8 commands

1Port to scan

-p

2Output file

-o

3Packets per second

--rate

4Banner grab

--banner

5File with IPs/subnets to exclude

--exclude-file

6Output format (csv, json)

--output-module

7Probe type (tcp_syn, icmp_echo)

--probe-module

8Scan seed for reproducibility

--seed

When to Use

Internet-wide scanning for exposed services

Finding all web servers on a large IP block

Research and academic network measurement

Identifying vulnerable services across IP ranges

Open port discovery on cloud provider ranges

Notes & Tips

Capable of scanning the entire IPv4 internet in ~45 minutes on 10GbE

Requires root privileges for raw packet operations

Only scans one port at a time

Use responsibly and respect network policies

Common Errors & Solutions

Permission denied (raw sockets)

Run with sudo or set capabilities: sudo setcap cap_net_raw=ep /usr/sbin/zmap

Network congestion

Reduce rate with --rate flag to avoid overwhelming the network

# Debian/Ubuntu sudo apt install zmap # Fedora/RHEL sudo dnf install zmap # Build from source git clone https://github.com/zmap/zmap.git cd zmap cmake . && make && sudo make install # Verify zmap --version

# Scan port 80 on subnet zmap -p 80 10.0.0.0/8 # Scan with output to file zmap -p 443 192.168.0.0/16 -o results.csv # Rate-limited scan zmap -p 22 10.0.0.0/8 --rate=1000 # Banner grab zmap -p 80 --banner 10.0.0.0/8 # Exclude specific IPs/subnets zmap -p 8080 0.0.0.0/0 --exclude-file exclude.txt # JSON output zmap -p 443 --output-module=json 192.168.0.0/16 # Scan with custom probe module zmap -p 443 --probe-module=tcp_syn 10.0.0.0/8