bash-2.05a# scanrand
Destination required.
scanrand 1.0: Stateless TCP Scanner w/ Inverse SYN Cookies(HMAC-SHA1/32 in SEQ)
Component of: Paketto Keiretsu 1.0; Dan Kaminsky (dan@doxpara.com)
Example: scanrand -b10M 10.0.1.1-254:80,20-25,139
Def. Ports: Use [quick/squick/known/all] instead of explicitly naming ports
Options: -S/-L: Only send requests / Only listen for responses
-e/-E: Show negative responses / Only show negative responses
-t [timeout]: Wait n full seconds for the last response (10s)
-b[bandwidth]: Limit bandwidth consumption to n b/k/m/g bytes(0)
(0 supresses timeouts or maximizes bw utilization)
-N/-NN : Enable name resolution (Prefer Source/Dest)
-v : Mark packets being sent, as well as received
-vv : Output full packet traces to stderr
Addressing: -d [device]: Send requests from this L2 hardware device
-i [source]: Send requests from this L3 IP address
-p [ port]: Send requests from this L4 TCP Port
-s [ seed]: Use prespecified seed for scan verification
-f [ file]: Read list of targets from file
Experiments: -l [ttl-ttl]: Statelessly TCP Traceroute
-c : Try checking Inverse SYN Cookie on Traceroute
Notes: Use Control-C to exit before scanrand times out.
Be sure to use a longer timeout for slow scans!
[n]: estimated network distance from target host.
Be careful about available bandwidth -- use -b!
# Quick scan of local network
bash-2.05a# scanrand 10.0.1.1-254:quick
UP: 10.0.1.38:80 [01] 0.003s
UP: 10.0.1.110:443 [01] 0.017s
UP: 10.0.1.254:443 [01] 0.021s
UP: 10.0.1.57:445 [01] 0.024s
UP: 10.0.1.59:445 [01] 0.024s
UP: 10.0.1.38:22 [01] 0.047s
UP: 10.0.1.110:22 [01] 0.058s
UP: 10.0.1.110:23 [01] 0.058s
UP: 10.0.1.254:22 [01] 0.077s
UP: 10.0.1.254:23 [01] 0.077s
UP: 10.0.1.25:135 [01] 0.088s
UP: 10.0.1.57:135 [01] 0.089s
UP: 10.0.1.59:135 [01] 0.090s
UP: 10.0.1.25:139 [01] 0.097s
UP: 10.0.1.27:139 [01] 0.098s
UP: 10.0.1.57:139 [01] 0.099s
UP: 10.0.1.59:139 [01] 0.099s
UP: 10.0.1.38:111 [01] 0.127s
UP: 10.0.1.57:1025 [01] 0.147s
UP: 10.0.1.59:1025 [01] 0.147s
UP: 10.0.1.57:5000 [01] 0.156s
UP: 10.0.1.59:5000 [01] 0.157s
UP: 10.0.1.53:111 [01] 0.182s
# Quick scan of Slashdot. Hmm, bout 12 hops away?
bash-2.05a# scanrand www.slashdot.org
UP: 66.35.250.150:80 [12] 0.017s
UP: 66.35.250.150:443 [12] 0.018s
# Lets check that...ah. 13. Have to slow down to 2mbit.
bash-2.05a# scanrand -b2m -l1-13 www.slashdot.org
002 = 63.251.53.219|80 [02] 0.018s( 10.0.1.11 -> 66.35.250.150 )
001 = 64.81.64.1|80 [01] 0.031s( 10.0.1.11 -> 66.35.250.150 )
003 = 63.251.63.79|80 [03] 0.044s( 10.0.1.11 -> 66.35.250.150 )
004 = 63.211.143.17|80 [04] 0.066s( 10.0.1.11 -> 66.35.250.150 )
005 = 209.244.14.193|80 [05] 0.084s( 10.0.1.11 -> 66.35.250.150 )
006 = 208.172.147.201|80 [08] 0.099s( 10.0.1.11 -> 66.35.250.150 )
007 = 208.172.146.104|80 [06] 0.119s( 10.0.1.11 -> 66.35.250.150 )
008 = 208.172.156.157|80 [08] 0.140s( 10.0.1.11 -> 66.35.250.150 )
009 = 208.172.156.198|80 [08] 0.167s( 10.0.1.11 -> 66.35.250.150 )
010 = 66.35.194.196|80 [09] 0.187s( 10.0.1.11 -> 66.35.250.150 )
011 = 66.35.194.58|80 [09] 0.208s( 10.0.1.11 -> 66.35.250.150 )
012 = 66.35.212.174|80 [10] 0.229s( 10.0.1.11 -> 66.35.250.150 )
UP: 66.35.250.150:80 [12] 0.241s
# Activate DNS resolution (better done as a postprocess, though.)
bash-2.05a# scanrand -b2m -N -l1-13 www.slashdot.org
001 = 64.81.64.1|80 [01] 0.020s( gw081-064-001-sfo1.dsl-isp.net)
002 = 63.251.53.219|80 [02] 0.030s(border5.g3-4.speakeasy-29.sfo.pnap.)
003 = 63.251.63.79|80 [03] 0.053s( core5.ge3-0-bbnet2.sfo.pnap.net)
004 = 63.211.143.17|80 [04] 0.092s(gige4-0-233.ipcolo1.SanFrancisco1.L)
005 = 209.244.14.193|80 [05] 0.121s(gigabitethernet4-0.core1.SanFrancis)
006 = 208.172.147.201|80 [08] 0.123s( acr1-so-2-0-0.SantaClara.cw.net)
007 = 208.172.146.104|80 [06] 0.137s( agr4-loopback.SantaClara.cw.net)
008 = 208.172.156.157|80 [08] 0.150s( dcr2-so-1-3-0.SantaClara.cw.net)
009 = 208.172.156.198|80 [08] 0.168s( ibr01-p4-0.sntc08.exodus.net)
010 = 66.35.194.196|80 [09] 0.190s( dcr02-g10-1.sntc08.exodus.net)
011 = 66.35.194.58|80 [09] 0.211s( csr01-ve242.sntc08.exodus.net)
012 = 66.35.212.174|80 [10] 0.239s( 66.35.212.174)
UP: 66.35.250.150:80 [12] 0.313s( sc8.slashdot.org)
# Lets combine host scanning and tracerouting...why not, it's fast enough :-)
bash-2.05a# scanrand -b 1m -l 1-10 64-66.5,8,15-17.1.1:80
001 = 64.81.64.1|80 [01] 0.021s( 10.0.1.11 -> 64.5.1.1 )
001 = 64.81.64.1|80 [01] 0.037s( 10.0.1.11 -> 65.5.1.1 )
001 = 64.81.64.1|80 [01] 0.054s( 10.0.1.11 -> 66.5.1.1 )
002 = 63.251.53.219|80 [02] 0.059s( 10.0.1.11 -> 64.5.1.1 )
002 = 63.251.53.219|80 [02] 0.088s( 10.0.1.11 -> 65.5.1.1 )
002 = 63.251.53.219|80 [02] 0.101s( 10.0.1.11 -> 66.5.1.1 )
003 = 63.251.63.1|80 [03] 0.118s( 10.0.1.11 -> 64.5.1.1 )
003 = 63.251.63.67|80 [03] 0.167s( 10.0.1.11 -> 66.5.1.1 )
004 = 160.81.100.1|80 [04] 0.189s( 10.0.1.11 -> 64.5.1.1 )
004 = 206.24.216.193|80 [04] 0.219s( 10.0.1.11 -> 66.5.1.1 )
005 = 144.232.3.169|80 [05] 0.240s( 10.0.1.11 -> 64.5.1.1 )
005 = 206.24.210.61|80 [05] 0.291s( 10.0.1.11 -> 66.5.1.1 )
006 = 144.232.3.193|80 [06] 0.324s( 10.0.1.11 -> 64.5.1.1 )
006 = 192.205.32.109|80 [07] 0.340s( 10.0.1.11 -> 66.5.1.1 )
007 = 144.232.9.214|80 [07] 0.379s( 10.0.1.11 -> 64.5.1.1 )
007 = 12.122.11.217|80 [07] 0.413s( 10.0.1.11 -> 66.5.1.1 )
008 = 144.232.18.42|80 [08] 0.444s( 10.0.1.11 -> 64.5.1.1 )
009 = 144.232.6.126|80 [09] 0.508s( 10.0.1.11 -> 64.5.1.1 )
009 = 12.122.11.106|80 [08] 0.571s( 10.0.1.11 -> 66.5.1.1 )
001 = 64.81.64.1|80 [01] 0.620s( 10.0.1.11 -> 64.8.1.1 )
010 = 12.123.24.137|80 [09] 0.632s( 10.0.1.11 -> 66.5.1.1 )
001 = 64.81.64.1|80 [01] 0.637s( 10.0.1.11 -> 65.8.1.1 )
001 = 64.81.64.1|80 [01] 0.654s( 10.0.1.11 -> 66.8.1.1 )
002 = 63.251.53.219|80 [02] 0.658s( 10.0.1.11 -> 64.8.1.1 )
002 = 63.251.53.219|80 [02] 0.679s( 10.0.1.11 -> 65.8.1.1 )
002 = 63.251.53.219|80 [02] 0.700s( 10.0.1.11 -> 66.8.1.1 )
003 = 63.251.63.79|80 [03] 0.718s( 10.0.1.11 -> 64.8.1.1 )
003 = 63.251.63.70|80 [03] 0.767s( 10.0.1.11 -> 66.8.1.1 )
004 = 63.211.143.17|80 [04] 0.788s( 10.0.1.11 -> 64.8.1.1 )
004 = 63.145.224.1|80 [05] 0.829s( 10.0.1.11 -> 66.8.1.1 )
005 = 209.244.14.197|80 [05] 0.847s( 10.0.1.11 -> 64.8.1.1 )
005 = 205.171.14.97|80 [06] 0.891s( 10.0.1.11 -> 66.8.1.1 )
006 = 209.247.10.233|80 [07] 0.908s( 10.0.1.11 -> 64.8.1.1 )
006 = 205.171.205.30|80 [06] 0.949s( 10.0.1.11 -> 66.8.1.1 )
007 = 64.159.0.218|80 [08] 0.958s( 10.0.1.11 -> 64.8.1.1 )
007 = 165.117.48.117|80 [08] 1.000s( 10.0.1.11 -> 66.8.1.1 )
008 = 64.159.2.164|80 [08] 1.019s( 10.0.1.11 -> 64.8.1.1 )
009 = 65.57.86.2|80 [13] 1.089s( 10.0.1.11 -> 64.8.1.1 )
009 = 165.117.68.161|80 [13] 1.134s( 10.0.1.11 -> 66.8.1.1 )
008 = 165.117.67.241|80 [14] 1.141s( 10.0.1.11 -> 66.8.1.1 )
010 = 66.109.14.137|80 [12] 1.150s( 10.0.1.11 -> 64.8.1.1 )
001 = 64.81.64.1|80 [01] 1.205s( 10.0.1.11 -> 64.15.1.1 )
001 = 64.81.64.1|80 [01] 1.221s( 10.0.1.11 -> 64.16.1.1 )
001 = 64.81.64.1|80 [01] 1.253s( 10.0.1.11 -> 64.17.1.1 )
010 = 165.117.200.77|80 [10] 1.260s( 10.0.1.11 -> 66.8.1.1 )
001 = 64.81.64.1|80 [01] 1.271s( 10.0.1.11 -> 65.15.1.1 )
001 = 64.81.64.1|80 [01] 1.287s( 10.0.1.11 -> 65.16.1.1 )
001 = 64.81.64.1|80 [01] 1.304s( 10.0.1.11 -> 65.17.1.1 )
001 = 64.81.64.1|80 [01] 1.322s( 10.0.1.11 -> 66.15.1.1 )
001 = 64.81.64.1|80 [01] 1.353s( 10.0.1.11 -> 66.16.1.1 )
001 = 64.81.64.1|80 [01] 1.371s( 10.0.1.11 -> 66.17.1.1 )
002 = 63.251.53.219|80 [02] 1.387s( 10.0.1.11 -> 64.15.1.1 )
002 = 63.251.53.219|80 [02] 1.407s( 10.0.1.11 -> 64.16.1.1 )
002 = 63.251.53.219|80 [02] 1.427s( 10.0.1.11 -> 64.17.1.1 )
002 = 63.251.53.219|80 [02] 1.448s( 10.0.1.11 -> 65.15.1.1 )
002 = 63.251.53.219|80 [02] 1.467s( 10.0.1.11 -> 65.16.1.1 )
002 = 63.251.53.219|80 [02] 1.478s( 10.0.1.11 -> 65.17.1.1 )
002 = 63.251.53.219|80 [02] 1.499s( 10.0.1.11 -> 66.15.1.1 )
002 = 63.251.53.219|80 [02] 1.529s( 10.0.1.11 -> 66.16.1.1 )
002 = 63.251.53.219|80 [02] 1.541s( 10.0.1.11 -> 66.17.1.1 )
003 = 63.251.63.3|80 [03] 1.638s( 10.0.1.11 -> 65.16.1.1 )
003 = 63.251.63.14|80 [03] 1.659s( 10.0.1.11 -> 65.17.1.1 )
003 = 63.251.63.67|80 [03] 1.727s( 10.0.1.11 -> 66.17.1.1 )
004 = 12.126.195.77|80 [04] 1.819s( 10.0.1.11 -> 65.16.1.1 )
004 = 63.211.143.17|80 [04] 1.842s( 10.0.1.11 -> 65.17.1.1 )
004 = 206.24.216.193|80 [04] 1.899s( 10.0.1.11 -> 66.17.1.1 )
005 = 12.123.13.58|80 [05] 2.012s( 10.0.1.11 -> 65.16.1.1 )
005 = 209.244.14.193|80 [05] 2.018s( 10.0.1.11 -> 65.17.1.1 )
005 = 206.24.210.61|80 [05] 2.081s( 10.0.1.11 -> 66.17.1.1 )
006 = 209.247.10.233|80 [07] 2.198s( 10.0.1.11 -> 65.17.1.1 )
006 = 208.172.146.103|80 [06] 2.261s( 10.0.1.11 -> 66.17.1.1 )
007 = 12.122.10.26|80 [08] 2.368s( 10.0.1.11 -> 65.16.1.1 )
007 = 209.247.11.169|80 [08] 2.423s( 10.0.1.11 -> 65.17.1.1 )
007 = 208.172.156.153|80 [08] 2.441s( 10.0.1.11 -> 66.17.1.1 )
008 = 209.247.11.182|80 [08] 2.603s( 10.0.1.11 -> 65.17.1.1 )
008 = 208.172.156.58|80 [09] 2.621s( 10.0.1.11 -> 66.17.1.1 )
009 = 12.122.12.58|80 [09] 2.762s( 10.0.1.11 -> 65.16.1.1 )
009 = 209.245.208.30|80 [09] 2.783s( 10.0.1.11 -> 65.17.1.1 )
009 = 208.172.146.19|80 [09] 2.810s( 10.0.1.11 -> 66.17.1.1 )
010 = 12.123.16.233|80 [10] 2.933s( 10.0.1.11 -> 65.16.1.1 )
010 = 216.212.127.198|80 [14] 2.969s( 10.0.1.11 -> 65.17.1.1 )
010 = 206.24.241.178|80 [13] 3.000s( 10.0.1.11 -> 66.17.1.1 )
006 = 12.122.11.81|80 [07] 4.226s( 10.0.1.11 -> 65.16.1.1 )
# Split mode operation. Only thing syncing these two scans is the crypto.
bash-2.05a# scanrand -t0 -L -s this_is_a_demo &
[1] 39294
bash-2.05a# scanrand -S -s this_is_a_demo www.slashdot.org
bash-2.05a# UP: 66.35.250.150:80 [12] 16.062s
UP: 66.35.250.150:443 [12] 16.063s
bash-2.05a# scanrand -S -s this_is_a_demo 10.0.1.1. -254:quick
UP: 10.0.1.38:80 [01] 42.419s
UP: 10.0.1.110:443 [01] 42.432s
UP: 10.0.1.254:443 [01] 42.437s
UP: 10.0.1.57:445 [01] 42.440s
UP: 10.0.1.59:445 [01] 42.440s
UP: 10.0.1.38:22 [01] 42.463s
UP: 10.0.1.110:22 [01] 42.474s
UP: 10.0.1.110:23 [01] 42.474s
UP: 10.0.1.254:22 [01] 42.493s
UP: 10.0.1.254:23 [01] 42.493s
UP: 10.0.1.25:135 [01] 42.504s
UP: 10.0.1.57:135 [01] 42.505s
UP: 10.0.1.59:135 [01] 42.506s
UP: 10.0.1.25:139 [01] 42.514s
UP: 10.0.1.27:139 [01] 42.514s
UP: 10.0.1.57:139 [01] 42.515s
UP: 10.0.1.59:139 [01] 42.516s
UP: 10.0.1.38:111 [01] 42.543s
UP: 10.0.1.57:1025 [01] 42.563s
UP: 10.0.1.59:1025 [01] 42.564s
UP: 10.0.1.57:5000 [01] 42.573s
UP: 10.0.1.59:5000 [01] 42.574s
bash-2.05a# UP: 10.0.1.53:111 [01] 42.700s
UP: 10.0.1.53:111 [01] 46.078s
