ZBanner: Fast Stateless Scanning Capable of Obtaining Responses over TCP

Fast large-scale network scanning is an important way to understand internet service configurations and security in real time, among which stateless scan is representative. Existing stateless scanners can perform single-packet scans for internet-wide network measurements but are limited to host discovery or port scanning. To obtain further information over TCP, slower stateful scanners must be used in conjunction which spend more time and memory because of connection state maintenance. This paper proposes a novel stateless scanning method, which can establish TCP connections and obtain further responses in a completely stateless manner. Based on this method, we implement a stateless scanner named ZBanner. Experiments show that ZBanner performs better than current state-of-the-art solutions in terms of scan rate and memory usage. ZBanner achieves a scan rate at least three times faster than current tools for generic ports and over 90 times faster for open ports while keeping a minimum and stable memory usage.