Who Is Scanning the Internet?
Roman Trapickin · TU München - Informatik · 2015
Today’s port scanning software is able to perform massive port scans up to the complete IPv4 space within minutes. Once a device is connected to the Internet, it will be almost immediately scanned for open ports and services. Most of these scans are done by anonymous individuals, in particular targeting at finding and exploiting system vulnerabilities. However, there is also a variety of individuals and organizations openly practicing massive port scanning and pursuing dierent objectives. In this paper we will introduce several scanning entities, while emphasizing their motives. In addition we will propose an entity classification model. In order to endorse further understanding of the topic we will also discuss port scanning as a measurement discipline as well as introduce the contemporary port scanning software used for Internet-wide scans.