zmap

all

Fast, open-source network scanner for Internet-wide surveys. See also: `hping3`, `masscan`, `naabu`, `nmap`, `rustscan`.

Options (8)

-p, --target-portsboolean

Scan a subnet or full IPv4 space for a specific TCP port (default: 80)

Example: zmap {{SUBNETS}} {{[-p|--target-ports]}} {{port}}

-o, --output-fileboolean

Output results to a CSV file with custom fields

Example:

zmap {{[-o|--output-file]}} {{path/to/output_file.csv}} {{[-f|--output-fields]}} "{{saddr,daddr,sport,dport}}" {{SUBNETS}}

-f, --output-fieldsboolean

Output results to a CSV file with custom fields

Example:

zmap {{[-o|--output-file]}} {{path/to/output_file.csv}} {{[-f|--output-fields]}} "{{saddr,daddr,sport,dport}}" {{SUBNETS}}

-r, --rateboolean

Limit the scan rate to a specific number of packets per second

Example: zmap {{[-r|--rate]}} {{packets_per_second}} {{SUBNETS}}

-d, --dryrunboolean

Perform a dry run without sending packets

Example: zmap {{[-d|--dryrun]}} {{SUBNETS}}

-b, --blocklist-fileboolean

Exclude subnets using a blocklist file in CIDR notation

Example: zmap {{[-b|--blocklist-file]}} {{path/to/blocklist.txt}} {{SUBNETS}}

-S, --source-ipboolean

Set a specific source IP for scan packets

Example: zmap {{[-S|--source-ip]}} {{source_ip}} {{SUBNETS}}

-n, --max-targetsboolean

Cap the number/percentage of targets to probe (e.g. 1000 IP/port pairs)

Example: zmap {{[-n|--max-targets]}} {{1000}} {{SUBNETS}} {{[-p|--target-ports]}} {{port1,port2-port3}}

Scan a subnet or full IPv4 space for a specific TCP port (default: 80)

zmap SUBNETS [-p|--target-ports] port

Scan specific ports or port ranges across a subnet

zmap [-p|--target-ports] port1,port2-port3,... SUBNETS

Output results to a CSV file with custom fields

zmap [-o|--output-file] path/to/output_file.csv [-f|--output-fields] "saddr,daddr,sport,dport" SUBNETS

Limit the scan rate to a specific number of packets per second

zmap [-r|--rate] packets_per_second SUBNETS

Perform a dry run without sending packets

zmap [-d|--dryrun] SUBNETS

Exclude subnets using a blocklist file in CIDR notation

zmap [-b|--blocklist-file] path/to/blocklist.txt SUBNETS

Set a specific source IP for scan packets

zmap [-S|--source-ip] source_ip SUBNETS

Cap the number/percentage of targets to probe (e.g. 1000 IP/port pairs)

zmap [-n|--max-targets] 1000 SUBNETS [-p|--target-ports] port1,port2-port3