Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My company has a very large distributed network which we scan monthly for vulnerability assessment. As part of that scanning, we try to find all accessible network hosts with a ping sweep. Since zmap can be used to map the entire internet (according to reports) in around 45 minutes, could the tool be used to map an organization's network quickly also?

Could you do this by restricting the address space in the blacklist file, or would you need to recode the tool to handle this use case?

share|improve this question
add comment

1 Answer

From the zmap documentation:

The blacklist file will list subnets to exclude, in CIDR notation (e.g. 192.168.0.0/16), one-per line. It is recommended you use this to exclude RFC 1918 addresses, multicast, IANA reserved space, and other IANA special-purpose addresses. An example blacklist file is provided in conf/blacklist.example for this purpose.

So work out what ranges you can blacklist without removing addresses you own and add them into the blacklist file.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.