Install zmap with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman

Project links

• Homepage
• Repository
• Upstream docs
• Package manager page

Commands and aliases

• zblocklist
• ziterate
• zmap
• ztee

Project history

The zmap/zmap repository was created in January 2013, and the project debuted publicly with the 2013 USENIX Security paper by Zakir Durumeric, Eric Wustrow, and J. Alex Halderman at the University of Michigan. The paper introduced ZMap as a modular open-source scanner designed for Internet-wide surveys, not host-by-host penetration testing.

The ZMap Project site describes the broader project as starting in 2013 with ZMap, followed a year later by ZGrab for application-layer scanning. That suite expanded into a family of measurement tools and libraries for hosts, services, DNS, TLS, and Web PKI research.

In 2014, the Zippier ZMap work described optimizations for 10 Gbps scanning, including parallelized address generation, improved blacklisting, and zero-copy packet I/O. The later Ten Years of ZMap paper documents how ZMap's packet construction, address generation, and operational behavior changed as maintainers learned from real Internet scanning.

Adoption history

ZMap's adoption is unusually well documented. The 2024 Ten Years of ZMap paper says that since the 2013 release, networking and security researchers used the scanner in hundreds of research papers and that security companies built products on top of it for attack-surface and dependency monitoring.

The same work notes a darker adoption path: ZMap's speed made it useful to attackers as well as defenders. That dual-use reality shaped the project's attention to blocklists, scan etiquette, packet behavior, and the broader ethics of Internet-wide measurement.

How it is used

ZMap is used when the question is about a service across the Internet rather than all services on one host. A user selects a probe module and target port, supplies allow/block-list policy and rate limits, then pipes responsive hosts to downstream tooling such as ZGrab for protocol handshakes or to custom analysis pipelines.

Operationally, good use means rate-limiting, honoring exclusion lists, using clear source identification, and treating scan results as sensitive measurement data. ZMap is powerful enough that responsible configuration is part of the tool's practical meaning.

Why package nerds care

ZMap is one of the canonical research-to-package success stories in security tooling. It compressed a job that once required weeks or many machines into a Unix-installable scanner, which changed the ergonomics of Internet measurement.

For package nerds, it also anchors a recognizable ecosystem: zmap for fast probes, zgrab for application-layer collection, zdns for DNS measurement, zcrypto for protocol parsing, and zlint for Web PKI linting.

Timeline

• 2013-01-23: The zmap/zmap GitHub repository is created.
• 2013-08: ZMap is presented at USENIX Security 13.
• 2014-08: Zippier ZMap presents 10 Gbps Internet-wide scanning optimizations.
• 2014: The ZMap Project releases ZGrab for application-layer scanning.
• 2024-11: Ten Years of ZMap analyzes a decade of adoption and operational evolution.

Related projects

• Nmap is the classic host and network scanner that ZMap is often contrasted with for Internet-wide single-port scans.
• ZGrab, ZDNS, ZCrypto, ZLint, and Censys are closely related ZMap ecosystem projects and downstream uses.
• Masscan is an adjacent high-speed scanner in the same broad space.

Sources

• https://api.github.com/repos/zmap/zmap
• https://github.com/zmap/zmap
• https://par.nsf.gov/servlets/purl/10553593
• https://www.usenix.org/conference/usenixsecurity13/technical-sessions/paper/durumeric
• https://www.usenix.org/conference/woot14/workshop-program/presentation/adrian
• https://zmap.io/about