On the origin of scanning: the impact of location on Internet-wide scans

Gerry Wan, Liz Izhikevich, David Adrian, Katsunari Yoshioka, Ralph Holz, Christian Rossow, Zakir Durumeric

Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

22 Citations (Scopus)
234 Downloads (Pure)


Fast IPv4 scanning has enabled researchers to answer a wealth of security and networking questions. Yet, despite widespread use, there has been little validation of the methodology's accuracy, including whether a single scan provides sufficient coverage. In this paper, we analyze how scan origin affects the results of Internet-wide scans by completing three HTTP, HTTPS, and SSH scans from seven geographically and topologically diverse networks. We find that individual origins miss an average 1.6-8.4% of HTTP, 1.5-4.6% of HTTPS, and 8.3-18.2% of SSH hosts. We analyze why origins see different hosts, and show how permanent and temporary blocking, packet loss, geographic biases, and transient outages affect scan results. We discuss the implications for scanning and provide recommendations for future studies.

Original languageEnglish
Title of host publicationIMC '20
Subtitle of host publicationProceedings of the ACM Internet Measurement Conference
Number of pages18
ISBN (Electronic)9781450381383
ISBN (Print)978-1-4503-8138-3
Publication statusPublished - Oct 2020
EventACM Internet Measurement Conference, IMC 2020 - Online
Duration: 27 Oct 202029 Oct 2020


ConferenceACM Internet Measurement Conference, IMC 2020
Abbreviated titleIMC


  • Cybersecurity
  • 22/3 OA procedure


Dive into the research topics of 'On the origin of scanning: the impact of location on Internet-wide scans'. Together they form a unique fingerprint.

Cite this