Using one gigabit per second of network bandwidth, ZMap can scan the entire IPv4address space in 44 minutes on a single port.[3] With a ten gigabit connection, ZMap scan can complete a scan in under five minutes.[4]
ZMap iterates on techniques utilized by its predecessor, Nmap, by altering the scanning method in a few key areas. Nmap sends out individual signals to each IP address and waits for a reply. As replies return, Nmap compiles them into a database to keep track of responses, a process that slows down the scanning process. In contrast, ZMap uses cyclicmultiplicative groups, which allows ZMap to scan the same space roughly 1,300 times faster than Nmap.[6] The ZMap software takes every number from 1 to 232-1 and creates an iterative formula that ensures that each of the possible 32-bit numbers is visited once in a pseudorandom order.[3] Building the initial list of numbers for every IP address takes upfront time, but it is a fraction of what is required to aggregate a list of every sent and received probe. This process ensures that once ZMap starts sending probes out to different IPs, an accidental denial of service could not occur because an abundance of transmissions would not converge on one subnet at the same time.[7]
ZMap also speeds up the scanning process by sending a probe to every IP address only once by default, whereas Nmap resends a probe when it detects a connection delay or fails to get a reply.[8] This results in about 2% of IP addresses being missed during a typical scan, but when processing billions of IP address, or potential IoT devices being targeted by cyberattackers, 2% is an acceptable tolerance.[5]
^Lee, Seungwoon; Im, Sun-Young; Shin, Seung-Hun; Roh, Byeong-hee; Lee, Cheolho (2016). "Implementation and vulnerability test of stealth port scanning attacks using ZMap of censys engine". 2016 International Conference on Information and Communication Technology Convergence (ICTC). pp. 681–683. doi:10.1109/ICTC.2016.7763561. ISBN978-1-5090-1325-8. S2CID13876287.
^Arzhakov, Anton V; Babalova, Irina F (2017). "Analysis of current internet wide scan effectiveness". 2017 IEEE Conference of Russian Young Researchers in Electrical and Electronic Engineering (EICon Rus). pp. 96–99. doi:10.1109/EIConRus.2017.7910503. ISBN978-1-5090-4865-6. S2CID44797603.
