Scanner

Masscan is a classic and extremely high-speed network scanner. This article starts from implementation details to analyze how Masscan sends and receives packets directly at the user level, how it distinguishes responses generated by itself, as well as its target randomization and high-performance network card access technologies. 1. Masscan’s User-Level Sending/Receiving (libpcap) Masscan does not use the operating system’s full protocol stack, but instead sends and receives raw data packets directly on Linux based on libpcap. This brings several important impacts and limitations: ...

In cybersecurity testing and information gathering, operations such as port scanning, directory scanning, and vulnerability detection often require sending a large number of requests to the target. Without reasonable rate limiting control, it will not only lead to excessive occupation of network bandwidth and system resources but may also trigger firewall/IDS detection and blocking. To balance efficiency and stealth, rate limiting mechanisms are particularly important. Among them, Token Bucket is a common rate limiting algorithm, often used for traffic limiting at gateways, but it can also be used in scanners. ...