Internet Spelunking: IPv6 Scanning and Device Fingerprinting
summary
Shadowserver scans tens of protocols from 37 servers over two 10Gb links, using ZMap/ZGrab, Condor job scheduling and a custom UDP sender called Railgun, reporting ~149 million unique IPs daily after sending billions of probes (order 10^11 UDP, 2.25×10^11 TCP) and performing millions of full handshakes; IPv4 population scans complete in ~4 hours, IPv6 uses curated hitlists (~814M addresses) and drops throughput to ~58k IPs/s due to 1280‑byte minima. A rule engine with ~1,200 signatures classifies 173 vendors (~30M device IDs/day) enabling large‑scale device fingerprinting. ZMap
AI-written summary · about
chapters (7)
- 0:00Start
- 12:40Scanning Methodology
- 13:15TCP Scans
- 21:08IPv6 Scans (Observations)
- 26:49Device Identification - Scan rules
- 27:03Example fingerprinting rule - iRobot Roomba
- 28:31Device Identification - Siemens SIMATIC S7-300 (2022-06-21)
related talks
26mInternet Scanning - Current State and Lessons Learned
43mAttack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners
59mCatching Malware En Masse: DNS and IP Style
44mNetsec is Dead(?): Modern Network Fingerprinting for...
24mImproving Internet-Wide Scanning with Dynamic Scanning
48mKnock knock, who's there Identifying assets in the cloud
52mInvestigating DDOS - Architecture Actors and Attribution
48mWe’re not in HTTP anymore: Investigating WebSocket Server Security