Sweep large IP ranges for open ports at line speed

zmap scans enormous IP ranges by sending a single stateless packet per target and listening for responses, rather than tracking per-connection state. That design covers huge address spaces at very high packet rates, which is why teams use it for internet-wide surveys and for sweeping large internal ranges for a specific open port.

You control the scan with probe and pacing options. A probe module such as tcp_synscan decides what packets go out, --target-ports sets which ports to test, and --rate or --bandwidth caps how fast it sends so you stay within your link and your rules of engagement. Allowlist and blocklist files constrain the scan to or away from specific CIDR ranges, and sharding splits one scan across machines.

On Trickest, zmap is a Network node that reads a target range and writes a file and a folder of responsive hosts. Run it as the first stage of a wide survey to find which addresses answer on a port, then feed those results to a banner grabber that fingerprints each open service.