ZMap: Scan the Entire IPv4 Space in Under 45 Minutes

ZMap revolutionizes network reconnaissance by completing Internet-wide scans in minutes, not days. This powerful open-source tool transforms how security researchers, network administrators, and academics approach large-scale network discovery. Ready to unlock blistering scan speeds while maintaining ethical standards? This comprehensive guide delivers everything you need to master ZMap's capabilities.

The Brutal Reality of Traditional Network Scanning

Network discovery has always been a painful waiting game. Conventional tools crawl through address spaces at snail-like speeds, forcing researchers to choose between comprehensive coverage and practical timeframes. A full IPv4 scan using traditional methods could take weeks or months—completely impractical for modern cybersecurity research and threat intelligence.

ZMap shatters these limitations. Developed by researchers at the University of Michigan, this stateless single-packet scanner maps the entire public IPv4 address space on a single port in under 45 minutes using a standard gigabit connection. With optimized 10-gigabit setups, that drops to an astonishing 5 minutes.

This guide walks you through ZMap's architecture, real-world applications, installation procedures, and advanced techniques. You'll learn how to conduct ethical, high-speed scans while avoiding common pitfalls that plague inexperienced users. Whether you're hunting for vulnerable services, conducting academic research, or building threat intelligence platforms, ZMap delivers unmatched performance.

What Is ZMap and Why Is It Trending Now?

ZMap is a fast, stateless single-packet network scanner engineered specifically for Internet-wide network surveys. Unlike traditional port scanners that maintain connection state and wait for responses, ZMap fires probe packets at blistering speeds without tracking individual connections. This architectural decision eliminates memory overhead and unlocks unprecedented scanning velocity.

Created by Zakir Durumeric, Eric Wustrow, and J. Alex Halderman at the University of Michigan, ZMap emerged from academic research into Internet-scale security vulnerabilities. The tool first gained prominence through its role in discovering the Heartbleed vulnerability's global impact, demonstrating its power for large-scale security measurement.

Why ZMap dominates cybersecurity conversations in 2024:

• Speed revolution: Scans 3.7 billion IPv4 addresses in under 45 minutes
• Research gold standard: Cited in hundreds of peer-reviewed security papers
• Operational simplicity: Single-command execution with sensible defaults
• Ethical design: Built-in rate limiting and opt-out mechanisms
• Ecosystem integration: Seamlessly pairs with ZGrab 2 for deep banner grabbing

The tool's popularity surged as organizations realized traditional vulnerability management approaches couldn't keep pace with the rapidly expanding attack surface. Modern threat actors deploy infrastructure at cloud scale, demanding equally scalable defensive reconnaissance tools. ZMap answers this call with academic rigor and production-ready reliability.

Key Features That Make ZMap Unstoppable

Stateless Architecture for Maximum Velocity

ZMap's core innovation lies in its stateless design. Traditional scanners like Nmap maintain connection tables, track TCP states, and wait for timeouts—consuming massive memory and CPU resources. ZMap discards this overhead entirely. It fires probe packets and processes responses asynchronously, enabling scan rates exceeding 1.4 million packets per second on commodity hardware.

This architecture means zero connection tracking. Each packet is independent, allowing ZMap to saturate network links completely. The scanner doesn't wait for responses before sending the next probe, eliminating the latency bottleneck that cripples conventional tools.

Multi-Protocol Probe Modules

ZMap ships with fully implemented probe modules for diverse scanning scenarios:

• TCP SYN scans: The workhorse for service discovery and port enumeration
• ICMP probes: Network reachability and topology mapping
• DNS queries: Discovering open resolvers and measuring DNS infrastructure
• UPnP detection: Identifying vulnerable Internet-of-Things devices
• BACNET support: Critical for building management system security
• UDP probe framework: Customizable payload scanning for services like NTP, SNMP, and memcached

Each module optimizes packet generation for its specific protocol, ensuring accurate results at extreme speeds.

Real-Time Statistical Feedback

ZMap provides live scan metrics through its status output. Users monitor send rates, receive rates, packet drops, and hit rates in real-time. This immediate feedback enables dynamic scan adjustment, helping researchers optimize parameters on-the-fly and identify network bottlenecks instantly.

Cross-Platform Compatibility

Unlike many high-performance networking tools limited to Linux, ZMap operates seamlessly on GNU/Linux, macOS, and BSD systems. This flexibility allows security teams to deploy ZMap across heterogeneous environments without platform-specific modifications.

Ethical Scanning Safeguards

ZMap incorporates responsible scanning features by default. The tool includes automatic rate limiting, blacklist file support for opt-out networks, and clear documentation on ethical usage. These features help researchers avoid accidental denial-of-service conditions and maintain positive relationships with network operators.

Real-World Use Cases That Transform Security Operations

1. Internet-Wide Vulnerability Assessment

Security researchers use ZMap to identify vulnerable populations within hours of vulnerability disclosure. When Heartbleed emerged, ZMap scanned the entire IPv4 space to quantify exposed OpenSSL instances. This capability enables rapid risk assessment, helping organizations understand their exposure relative to the global internet.

Practical implementation involves scanning common vulnerability ports (e.g., 443 for Heartbleed, 3389 for BlueKeep) and piping results to ZGrab 2 for deep inspection. The entire process—from scan initiation to vulnerability confirmation—completes in under an hour.

2. Service Discovery and Attack Surface Mapping

Enterprise security teams leverage ZMap to discover forgotten public-facing services. By scanning all organizational IP ranges across 1,000+ ports, teams uncover shadow IT, misconfigured cloud instances, and unauthorized services. This comprehensive visibility is impossible with traditional scanners due to time constraints.

A typical enterprise scan covers multiple port ranges: sudo zmap -p 1-65535 -o enterprise_assets.csv 203.0.113.0/24. The output feeds into asset management platforms, providing a continuously updated inventory of internet-exposed services.

3. Academic Internet Measurement Research

Researchers studying Internet evolution, protocol adoption, or security posture rely on ZMap for longitudinal studies. The tool's speed enables monthly or weekly full-Internet scans, creating datasets that reveal trends in TLS adoption, IoT proliferation, or DDoS amplification vulnerability prevalence.

These studies inform policy decisions, standards development, and security best practices. ZMap's academic pedigree ensures reproducible results, with scan parameters documented in research papers for peer verification.

4. Threat Intelligence and Botnet Tracking

Cyber threat intelligence platforms integrate ZMap to track botnet infrastructure. By scanning for known botnet command-and-control ports and protocols, analysts identify newly compromised hosts and monitor botnet growth. The scanner's speed allows daily updates to threat feeds, providing defenders with near-real-time intelligence.

For example, scanning for Mirai botnet signatures on ports 23 and 2323 across the IPv4 space identifies vulnerable IoT devices recruited into DDoS armies. This intelligence drives proactive blocking and remediation efforts.

5. Certificate Transparency and TLS Ecosystem Monitoring

ZMap powers large-scale TLS certificate collection when combined with ZGrab 2. Researchers monitor the TLS ecosystem for misissued certificates, track CA compliance, and identify malicious domains using fraudulent certificates. This capability supports Certificate Transparency initiatives and enhances web PKI security.

Step-by-Step Installation and Setup Guide

Prerequisites

Before installing ZMap, ensure your system meets these requirements:

• Root privileges: ZMap requires raw socket access
• Gigabit Ethernet: To achieve advertised scan speeds
• Sufficient RAM: Minimum 2GB, 4GB+ recommended for large scans
• Modern Linux kernel: 3.0+ for optimal performance

Installation via Package Manager (Recommended)

For Ubuntu/Debian systems, installation is straightforward:

# Update package repositories
sudo apt update

# Install ZMap
sudo apt install zmap

# Verify installation
zmap --version

On macOS using Homebrew:

# Install Homebrew if not present
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

# Install ZMap
brew install zmap

# Verify installation
zmap --version

Building from Source

For the latest features or custom modifications, compile from source:

# Install build dependencies (Ubuntu/Debian)
sudo apt install build-essential cmake libgmp3-dev gengetopt libpcap-dev flex byacc libjson-c-dev pkg-config

# Clone the repository
git clone https://github.com/zmap/zmap.git
cd zmap

# Create build directory
mkdir build
cd build

# Configure with CMake
cmake ..

# Compile
make -j4

# Install system-wide
sudo make install

Initial Configuration

Create a blacklist file to exclude sensitive networks:

# Create blacklist directory
sudo mkdir -p /etc/zmap

# Create blacklist file with opt-out networks
sudo nano /etc/zmap/blacklist.conf

Add networks to exclude (one per line):

# Example blacklist entries
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

Test your configuration with a conservative scan:

# Scan port 80 on a small subnet at 10,000 packets/second
sudo zmap -p 80 -r 10000 -B 10M 203.0.113.0/24

Real Code Examples from the Repository

Example 1: Basic Internet-Wide HTTP Scan

This command replicates the README's simplest example, scanning for web servers on port 80:

# Scan entire IPv4 space for port 80 (HTTP) listeners
# Requires root privileges for raw socket access
sudo zmap -p 80

Output interpretation:

0:00 0%; send: 5 1 p/s (185 p/s avg); recv: 0 0 p/s (0 p/s avg); drops: 0 p/s (0 p/s avg); hitrate: 0.00%
52.8.107.196
0:01 0%; send: 10327 10.3 Kp/s (10.1 Kp/s avg); recv: 118 118 p/s (115 p/s avg); drops: 0 p/s (0 p/s avg); hitrate: 1.14%

The status line shows:

• send: Packets sent per second (10.3 Kp/s current, 10.1 Kp/s average)
• recv: Responses received per second (118 p/s)
• drops: Kernel-dropped packets (0 p/s indicates healthy scan)
• hitrate: Percentage of responsive hosts (1.14%)

Discovered IPs print to stdout in real-time, enabling pipeline processing.

Example 2: Targeted Network Scan with Output

For controlled environments, target specific networks and save results:

# Scan port 443 (HTTPS) on corporate network, save to CSV
sudo zmap -p 443 -o https_servers.csv --output-fields=* 203.0.113.0/24

The --output-fields=* argument includes all metadata: timestamp, scan parameters, and response data. The CSV format integrates seamlessly with analysis tools like pandas or Excel.

Example 3: UDP Probe Scanning

ZMap's UDP probe framework enables service-specific scanning. Here's an NTP amplification vulnerability check:

# Create UDP probe file (ntp_probe.bin)
echo -en "\x17\x00\x03\x2a\x00\x00\x00\x00" > ntp_probe.bin

# Scan for NTP servers using the probe
sudo zmap -M udp -p 123 --probe-args=file:ntp_probe.bin -o ntp_servers.csv

The -M udp flag activates UDP probe mode. The --probe-args specifies the payload file, allowing custom packet construction for any UDP service. This technique identifies vulnerable NTP servers that could be abused for DDoS amplification.

Example 4: Rate-Limited Ethical Scanning

Responsible scanning requires rate limiting. This example scans SSH servers conservatively:

# Scan port 22 at 1,000 packets/second with bandwidth cap
sudo zmap -p 22 -r 1000 -B 5M --blacklist-file=/etc/zmap/blacklist.conf -o ssh_hosts.txt

Parameters explained:

• -r 1000: Maximum 1,000 packets per second
• -B 5M: Bandwidth limit of 5 megabits/second
• --blacklist-file: Excludes opt-out networks
• -o ssh_hosts.txt: Saves discovered hosts to text file

This configuration minimizes network impact while still completing a full IPv4 scan in approximately 43 days—ideal for continuous monitoring scenarios.

Example 5: Integration with ZGrab 2 for Banner Grabbing

Combine ZMap's speed with ZGrab's depth for comprehensive reconnaissance:

# First, scan for HTTP services
sudo zmap -p 80 -o http_ips.txt

# Then, grab banners using ZGrab 2
cat http_ips.txt | zgrab2 http -p 80 -o http_banners.json

This two-phase approach leverages ZMap's stateless scanning to identify targets, then uses ZGrab 2's stateful TCP handshake and application-layer probing to extract server banners, HTTP headers, and TLS certificates. The JSON output enables structured analysis of service versions and vulnerabilities.

Advanced Usage & Best Practices

Achieving 10 Gbps Scanning Speeds

To reach ZMap's maximum performance, enable netmap or PF_RING:

# Install netmap kernel module
git clone https://github.com/luigirizzo/netmap
cd netmap/LINUX
./configure && make && sudo make install

# Run ZMap with netmap
sudo zmap -i netmap:eth0 -p 80 -r 1400000

The -i netmap:eth0 flag bypasses the kernel network stack, achieving 1.4 million packets per second—saturating 10 Gbps links. This requires dedicated hardware and careful coordination to avoid overwhelming upstream networks.

Optimizing for Low-Bandwidth Environments

When scanning from limited connections, adjust parameters for reliability:

# Conservative scan for home connections
sudo zmap -p 443 -r 500 -B 1M --retries=2 --cooldown-time=300

The --retries=2 parameter resends probes to unresponsive hosts, improving accuracy for lossy networks. --cooldown-time=300 waits 5 minutes after scanning to capture late responses.

Distributed Scanning Architecture

For organizations requiring continuous monitoring, distribute scans across multiple nodes:

# On scanner node 1 (covers 0.0.0.0/8 to 63.0.0.0/8)
sudo zmap -p 80 -o results_part1.csv 0.0.0.0/2

# On scanner node 2 (covers 64.0.0.0/8 to 127.0.0.0/8)
sudo zmap -p 80 -o results_part2.csv 64.0.0.0/2

Combine results centrally for a unified view. This approach scales linearly, enabling full-Internet scans every few minutes with sufficient nodes.

Blacklist Management at Scale

Maintain an effective blacklist to respect opt-out requests:

# Download IANA reserved networks
wget https://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.csv

# Generate blacklist from reserved ranges
awk -F',' 'NR>1 {print $1 "/8"}' ipv4-address-space.csv | grep -E "(RESERVED|UNALLOCATED)" > /etc/zmap/blacklist.conf

# Add custom opt-out networks
echo "198.51.100.0/24" >> /etc/zmap/blacklist.conf

Regularly update your blacklist and publish an abuse contact in scan packets using the --user-metadata flag.

Comparison with Alternatives

Why Choose ZMap?

ZMap strikes the perfect balance between raw speed and responsible design. While Masscan achieves higher packet rates, it lacks ZMap's ethical defaults and rich probe module ecosystem. Nmap remains superior for targeted, deep reconnaissance but cannot compete for Internet-scale surveys.

ZMap's academic foundation ensures reproducible research, with scan parameters documented in peer-reviewed publications. Its integration with the ZMap ecosystem (ZGrab 2, ZTag, ZBrowse) provides a complete pipeline from discovery to analysis.

For security teams requiring regular, comprehensive Internet visibility, ZMap's speed enables daily full-Internet scans—transforming threat intelligence from periodic snapshots to continuous monitoring.

Frequently Asked Questions

Is ZMap legal to use?

Yes, ZMap is legal research software. However, scanning without permission may violate laws like the Computer Fraud and Abuse Act (CFAA) in the US. Always scan responsibly, respect opt-out requests, and limit rates to minimize impact. Many researchers coordinate with CERT teams and ISPs before large-scale scans.

How fast can ZMap realistically scan?

On a standard gigabit connection: 45 minutes for full IPv4 space. With 10-gigabit and netmap: under 5 minutes. Actual speed depends on target port responsiveness, network conditions, and rate limiting. Most users achieve 10-50% of theoretical maximum due to ethical constraints and network overhead.

What's the difference between ZMap and ZGrab 2?

ZMap performs stateless discovery—it sends probes and records responses. ZGrab 2 executes stateful application-layer handshakes (TLS, SSH, HTTP) to extract banners and version information. Use ZMap for discovery, ZGrab for deep inspection. They integrate seamlessly in the ZMap ecosystem.

Do I need special hardware for 10 Gbps scanning?

Yes. Achieving 10 Gbps requires:

• 10 Gbps NIC with netmap or PF_RING support
• PCIe 3.0 x8 slot minimum for full throughput
• Modern CPU (3.0+ GHz, 4+ cores) for packet generation
• Kernel bypass drivers (netmap/PF_RING) to avoid stack overhead
• Dedicated scanning host (no other network-intensive applications)

How can I avoid being blocked while scanning?

Follow these best practices:

• Rate limit to 1,000-10,000 pps for most scans
• Use blacklist files to exclude known sensitive networks
• Scan during off-peak hours (reduce collateral impact)
• Publish abuse contact via --user-metadata flag
• Coordinate with ISPs for large-scale research scans
• Respect opt-out requests immediately

Can ZMap scan IPv6 networks?

ZMap currently focuses on IPv4 due to IPv6's vastly larger address space (2¹²⁸ vs 2³² addresses). Scanning the entire IPv6 space is computationally infeasible. However, ZMap can target specific IPv6 prefixes using the -6 flag in development builds, enabling targeted IPv6 surveys for known allocations.

What probe modules ship with ZMap?

ZMap 4.3.4 includes TCP SYN, ICMP echo, DNS query, UPnP discovery, BACNET, and a generic UDP probe framework. Users can develop custom modules in C for proprietary protocols. The UDP framework supports payload files, enabling scanning of NTP, SNMP, SSDP, and other UDP services without code modifications.

Conclusion: Embrace the Future of Network Reconnaissance

ZMap redefines what's possible in network scanning, transforming weeks-long surveys into minutes-long operations. Its stateless architecture, ethical design, and blistering speed make it indispensable for modern security research and threat intelligence. The tool's academic pedigree ensures reproducible results, while its active development community continuously expands capabilities.

For cybersecurity professionals, ZMap isn't just another tool—it's a paradigm shift. The ability to map global service populations in near-real-time enables proactive defense strategies that were science fiction a decade ago. Whether you're quantifying vulnerability exposure, tracking botnet evolution, or conducting Internet measurement research, ZMap delivers unmatched performance.

Ready to start scanning responsibly? Visit the official ZMap GitHub repository at https://github.com/zmap/zmap to download the latest release, join community discussions, and access comprehensive documentation. The future of network reconnaissance is here—don't get left behind using yesterday's tools.

Scan fast. Scan smart. Scan ethically.