Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

ZBanner: Fast Stateless Scanning Capable of Obtaining Responses over TCP

Chiyu Chen, Yuliang Lu, Guozheng Yang, Yi Xie, Shasha Guo

TL;DR

This paper tackles the challenge of obtaining information over TCP during fast large-scale scans, noting that existing stateless scanners cannot fetch beyond initial handshake. It introduces a stateless scanning model by simplifying the TCP finite state machine to allow complete handshake and response retrieval without per-connection state, enabling efficient information gathering. Building on this model, it presents ZBanner, a modular stateless scanner with extensible probe modules for banner grabbing, service identification, and TLS fingerprinting, and demonstrates improved scan rate and memory usage over stateful two-phase approaches. Results show up to approximately 3x faster generic-port scanning and up to over 90x faster for open ports on ordinary hardware, with about 98% coverage and minimal memory overhead, underscoring the method's practical impact for large-scale internet measurements.

Abstract

Fast large-scale network scanning is an important way to understand internet service configurations and security in real time, among which stateless scan is representative. Existing stateless scanners can perform single-packet scans for internet-wide network measurements but are limited to host discovery or port scanning. To obtain further information over TCP, slower stateful scanners must be used in conjunction which spend more time and memory because of connection state maintenance. Through simplifying TCP finite state machine, this paper proposes a novel stateless scanning model, which can establish TCP connections and obtain further responses in a completely stateless manner. Based on this model, we implement ZBanner, an improved modular stateless scanner that utilizes user-defined probes for identifying services and versions, fingerprinting TLS servers, etc. We present unique design of ZBanner and experimentally characterize its feasibility and performance. Experiments show that ZBanner performs better than current state-of-the-art solutions in terms of scan rate and memory usage. ZBanner achieves at least three times faster than current tools for generic ports and over 90 times faster for open ports while keeping a minimum and stable memory usage.

ZBanner: Fast Stateless Scanning Capable of Obtaining Responses over TCP

TL;DR

This paper tackles the challenge of obtaining information over TCP during fast large-scale scans, noting that existing stateless scanners cannot fetch beyond initial handshake. It introduces a stateless scanning model by simplifying the TCP finite state machine to allow complete handshake and response retrieval without per-connection state, enabling efficient information gathering. Building on this model, it presents ZBanner, a modular stateless scanner with extensible probe modules for banner grabbing, service identification, and TLS fingerprinting, and demonstrates improved scan rate and memory usage over stateful two-phase approaches. Results show up to approximately 3x faster generic-port scanning and up to over 90x faster for open ports on ordinary hardware, with about 98% coverage and minimal memory overhead, underscoring the method's practical impact for large-scale internet measurements.

Abstract

Fast large-scale network scanning is an important way to understand internet service configurations and security in real time, among which stateless scan is representative. Existing stateless scanners can perform single-packet scans for internet-wide network measurements but are limited to host discovery or port scanning. To obtain further information over TCP, slower stateful scanners must be used in conjunction which spend more time and memory because of connection state maintenance. Through simplifying TCP finite state machine, this paper proposes a novel stateless scanning model, which can establish TCP connections and obtain further responses in a completely stateless manner. Based on this model, we implement ZBanner, an improved modular stateless scanner that utilizes user-defined probes for identifying services and versions, fingerprinting TLS servers, etc. We present unique design of ZBanner and experimentally characterize its feasibility and performance. Experiments show that ZBanner performs better than current state-of-the-art solutions in terms of scan rate and memory usage. ZBanner achieves at least three times faster than current tools for generic ports and over 90 times faster for open ports while keeping a minimum and stable memory usage.
Paper Structure (25 sections, 12 figures, 6 tables, 1 algorithm)

This paper contains 25 sections, 12 figures, 6 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Works
  3. Stateless Scanning Technique
  4. Two-Phase Scan
  5. Stateless Scanning Model
  6. Analysis to Existing Stateless Machanism
  7. Construction of Scanning Model
  8. Design of ZBanner
  9. Asynchronous Mode with Callback Queue
  10. Handling Various Connection Anomalies
  11. Handling TCP Sliding Window Protocol
  12. Extensible Probe Module
  13. Evaluation
  14. Experimental Setup
  15. Scan Rate: Is It Too Fast over TCP?
  16. ...and 10 more sections

Figures (12)

  • Figure 1: Analysis to Stateless Mechanism of ZMap
  • Figure 2: Simplification of FSM in Specific Scanning Scenarios
  • Figure 3: Preliminarily Simplified FSM
  • Figure 4: Simplification of Communication Process in Scanning
  • Figure 5: Simplified FSM
  • ...and 7 more figures