Re:Masscan: scan the entire Internet in under 6 minutes, 10 ...
by dthunt on Sunday September 15, 2013 @11:46PM
(#6391515)
There are plenty of reasons to want to perform that kind of scan on the internet. Sometimes, if all you're looking for is a a sample of how many people are running version X of a product versus version Y, you really don't need to map the whole internet. You can just sweep for your port of interest across a few million random IPs and call it a day.
Sometimes, though, if you are building a directory, or if you just want a really fantastically beautiful map, you scan the whole shebang.
Doing it all in a few minutes is a little unncessary, though, even if it is neat how much better scanners have been getting lately. A scan that merely takes a few days is plenty fast.
Re:Masscan: scan the entire Internet in under 6 minutes, 10 ...
by malandrew on Monday September 16, 2013 @12:20AM
(#6391600)
The shorter time scale means that it is now getting easy enough for everybody to do it. With that in mind I feel like the responsible thing is to only release the source as an educational resource and also maintain a public data store of any results gathered by this tool so that people can perform analysis without having to fire so many packets at every machine on the Internet. Not providing a Datastore in Tarball format to mitigate the actual use is a tab irresponsible.
Re:Masscan: scan the entire Internet in under 6 minutes, 10 ...
by adestefan on Monday September 16, 2013 @10:03AM
(#6393284)
It's really not that easy for someone to do it. The problem is getting someone to give you a connection that can actually put that many packets onto the Internet. Even the author has issues with this points. See http://blog.erratasec.com/2013/09/masscan-entire-internet-in...
> The problem is that I don't have a 10-gbps network to test on. My ISP let's me go out to 100,000 packets/second as long as I deal with the abuse complaints, but that's around 44-mbps.
Re:Masscan: scan the entire Internet in under 6 minutes, 10 ...
by tobyjsullivan on Sunday September 15, 2013 @11:44PM
(#6391510)
I believe they (Errata Security) are using it for surveys of the internet landscape (i.e. What server software is running on open ports for web and SSH). But there are many other possibilities if you're creative. What about sending a GET request to every port 80 and indexing the results? A new form of web crawler.
In other words, is that a feature, or is it just a performance metric?