$ show idealeer/xmap
XMap is a high-performance network scanner designed for Internet-wide IPv4 and IPv6 address space scanning. It is a reimplementation and improvement of ZMap, featuring a modular architecture with interchangeable probe modules (ICMP, TCP, UDP, DNS), output modules (CSV, JSON, Redis), and interface identifier (IID) modules for target address generation. The tool uses cyclic groups for efficient, non-sequential address traversal, AES-based validation to prevent response spoofing, and Bloom filters for duplicate packet detection. It is actively used in security research and has been presented at multiple academic conferences. The repository contains significant code duplication among DNS probe modules, which increases maintenance burden.
The LLM identified 5 files worth highlighting for reuse:
Self-contained Bloom filter implementation for efficient duplicate detection. Uses bit array and multiple hash functions with configurable false positive rate. Demonstrates space-efficient probabilistic data structure design suitable for high-throughput network scanning.
Standalone AES encryption/decryption implementation following FIPS-197 standard. Includes key scheduling, block operations, and lookup tables. Demonstrates correct implementation of a cryptographic primitive with clear separation of concerns and no external dependencies beyond standard libraries.
Implements cyclic group mathematics for generating non-sequential permutations of IP address spaces. Uses GMP for large integer arithmetic to enable efficient, unbiased scanning of large address spaces. Demonstrates non-obvious application of number theory to solve network scanning performance challenges.
Uses AES-RNG to generate and validate packet validation bits to prevent spoofing. Integrates with the probe module system to secure network probes against response injection. Demonstrates a non-obvious technique for securing active network measurements using cryptographic primitives.
Implements a small domain-specific language for filtering scan results. Supports logical operations, comparisons, and field references with proper AST generation and evaluation. Demonstrates parsing and evaluation techniques for flexible output filtering in network scanning tools.