XMap is a high-performance network scanner designed for Internet-wide IPv4 and IPv6 address space scanning. It is a reimplementation and improvement of ZMap, featuring a modular architecture with interchangeable probe modules (ICMP, TCP, UDP, DNS), output modules (CSV, JSON, Redis), and interface identifier (IID) modules for target address generation. The tool uses cyclic groups for efficient, non-sequential address traversal, AES-based validation to prevent response spoofing, and Bloom filters for duplicate packet detection. It is actively used in security research and has been presented at multiple academic conferences. The repository contains significant code duplication among DNS probe modules, which increases maintenance burden.
masscan is a high-performance network port scanner capable of scanning the entire IPv4 Internet in under 5 minutes. Unlike typical scanners, it implements a custom TCP/IP stack to avoid kernel overhead, uses randomized probe ordering via a Feistel cipher (BlackRock) for stealth, and supports both IPv4 and IPv6. The scanner is architecturally a multithreaded C application with separate transmit and receive threads per network adapter, a lock-free ring buffer for inter-thread communication, and a plugin system for output formats (XML, JSON, binary, Redis) and protocol parsers (HTTP, SSH, SSL, SMB, etc.). Key entry points include main.c (initialization), main-conf.c (configuration), transmit_thread() (probe generation), and receive_thread() (response handling). External dependencies are minimal: libpcap (loaded dynamically) for raw packet I/O, and optional PF_RING for higher throughput. Lua scripting is also supported for custom extensions.