ProRT-IP vs ZMap

Comprehensive technical comparison between ProRT-IP and ZMap, the academic Internet measurement tool that transformed network research by scanning the entire IPv4 address space in under 45 minutes.

Executive Summary

ZMap revolutionized Internet measurement through stateless scanning architecture achieving 1.44 million pps at gigabit speeds (97-98% theoretical maximum) and 14.23 million pps at 10 gigabit speeds. Developed at the University of Michigan in 2013, ZMap completes full IPv4 scans in 42-45 minutes (gigabit) or 4 minutes 29 seconds (10 gigabit), representing a 1,300-fold speedup over Nmap for Internet-wide surveys.

ProRT-IP balances speed with comprehensive detection, achieving comparable stateless performance (10M+ pps, similar to ZMap gigabit) while maintaining 85-90% service detection accuracy through modern Rust async I/O architecture. ProRT-IP's stateful mode (50K+ pps) adds service version detection (500+ services), OS fingerprinting (2,600+ signatures), and TLS certificate analysis unavailable in ZMap's core.

The fundamental tradeoff: ZMap optimizes exclusively for horizontal scanning (many hosts, single port) through single-probe methodology and zero per-connection state, making it the gold standard for Internet-wide research but requiring separate tools (ZGrab2, LZR) for application-layer detection. ProRT-IP achieves comparable stateless speed (10M+ pps) while integrating comprehensive detection in a single tool, though ZMap reaches higher maximum speeds (14.23 Mpps) with specialized 10 gigabit hardware.

Quick Comparison

When to Use Each Tool

Use ZMap When:

✅ Internet-wide research surveys are the primary goal

• Academic network measurement studies (TLS certificates, protocol adoption)
• Full IPv4 scans in 42-45 minutes (gigabit) or 4 minutes 29 seconds (10 gigabit)
• Horizontal scanning (many hosts, single port) optimization
• Statistical sampling with mathematically rigorous randomization

✅ Maximum speed with 10 gigabit hardware is available

• 14.23 million pps (96% of theoretical 10 GigE maximum)
• PF_RING Zero Copy kernel bypass for ultimate performance
• Specialized scanning infrastructure with optimized configuration

✅ Single-probe methodology is acceptable

• 98% coverage sufficient (2% packet loss tolerated)
• Speed priority over perfect accuracy
• Time-critical Internet measurement requiring rapid completion

✅ Two-phase workflow with ZGrab2 is acceptable

• Layer 4 discovery (ZMap) + Layer 7 interrogation (ZGrab2) separation
• Ecosystem integration (ZDNS, LZR, ZLint, ZAnnotate) valuable
• Pipeline approach: zmap -p 443 | ztee results.csv | zgrab2 http

Use ProRT-IP When:

✅ Single-pass comprehensive assessment is required

• Service detection + OS fingerprinting + TLS certificates in one tool
• 10M+ pps stateless for rapid discovery (ZMap gigabit-class)
• 50K+ pps stateful with 85-90% detection accuracy
• No multi-tool pipeline orchestration needed

✅ Detection capabilities are critical

• Service version identification (500+ services, growing database)
• OS fingerprinting (Nmap-compatible, 2,600+ signatures)
• TLS certificate analysis (X.509v3, chain validation, SNI support)
• Banner grabbing for application-layer identification

✅ Production security operations require reliability

• Memory safety (Rust compile-time guarantees vs C manual memory)
• Comprehensive error handling (detailed actionable messages)
• Database storage with change detection over time
• Event-driven architecture for real-time monitoring

✅ Cross-platform consistency matters

• 10M+ pps stateless on Linux, Windows, macOS, FreeBSD (consistent)
• No platform-specific optimizations required
• Single binary deployment across diverse environments

✅ Multiple scan types needed

• 8 scan types (SYN, Connect, FIN, NULL, Xmas, ACK, UDP, Idle) vs ZMap's basic SYN/ICMP/UDP
• Firewall detection (ACK scan)
• Stealth techniques (FIN/NULL/Xmas)
• Anonymity (Idle scan via zombie hosts)

Speed Comparison

Benchmark Results (65,535-Port SYN Scan)

Notes:

• ZMap 10 GigE requires specialized hardware (Intel X540-AT2, PF_RING ZC kernel bypass)
• ProRT-IP stateless mode (10M+ pps) comparable to ZMap gigabit (1.44 Mpps)
• ProRT-IP stateful mode adds detection capabilities unavailable in ZMap core

Internet-Scale Scanning (IPv4 Single-Port)

ZMap vs Nmap Empirical Testing (1M hosts, TCP port 443):

• ZMap: ~10 seconds, 98.7% coverage (single probe)
• Nmap -T5 (max 2 probes): 45 minutes, 97.8% coverage
• Nmap (single probe): 24 minutes, 81.4% coverage

ZMap vs Masscan (10 GigE hardware):

• ZMap: 14.1 Mpps (94.6% line rate), single receive queue
• Masscan: 7.4 Mpps (49.6% line rate), dual receive-side scaling queues

Detection Capabilities

Service Version Detection

OS Fingerprinting

Key Difference: ZMap's stateless architecture fundamentally precludes OS fingerprinting (requires multiple probes and response correlation). ZGrab2 provides application-layer data but not OS detection. ProRT-IP integrates OS fingerprinting directly.

Feature Comparison

Scan Types

Advanced Features

Architecture Comparison

ZMap's Architecture

Language: C (highly optimized, kernel bypass options) Core Design: Stateless asynchronous scanning with mathematically rigorous randomization

Key Innovations:

1. Cyclic Multiplicative Groups for Address Permutation:

   • Multiplicative group (Z/pZ)× modulo p where p = 2³² + 15 (smallest prime > 2³²)
   • Sequence a(i+1) = g × a(i) mod p produces complete random permutation
   • Requires storing only 3 integers: primitive root g, first address a₀, current address a(i)
   • Mathematically rigorous randomization suitable for statistical sampling

2. Stateless Scanning with UMAC Validation:

   • Zero per-connection state (eliminates memory overhead for billions of addresses)
   • UMAC (Universal Message Authentication Code) encodes validation in probe packets
   • Source port and sequence number contain cryptographic validation
   • Receiver independently validates responses without sender coordination

3. Asynchronous Send/Receive Threading:

   • Minimal shared state (independent sender and receiver threads)
   • Sender operates in tight loop at maximum NIC capacity
   • Receiver independently captures and validates via libpcap
   • Monitor thread tracks progress without synchronization overhead

4. Direct Ethernet Frame Generation:

   • Bypasses kernel TCP/IP stack entirely via raw sockets
   • Eliminates routing lookups, ARP cache checks, netfilter processing
   • PF_RING Zero Copy (10 GigE) provides direct userspace-to-NIC communication
   • Pre-caches static packet content, updates only host-specific fields

5. Constraint Tree Optimization:

   • Hybrid radix tree + /20 prefix array for complex blacklist processing
   • Enables 1,000+ blacklist entries without performance impact at 14+ Mpps
   • O(log n) recursive procedures map permutation index to allowed addresses

Strengths:

• Absolute maximum speed for horizontal scanning (14.23 Mpps at 10 GigE)
• Perfect randomization with mathematical proof (suitable for research sampling)
• Minimal memory footprint (~500MB full dedup or negligible with window method)
• 97-98% of theoretical network capacity utilization
• Proven at Internet scale (500+ academic papers, 33% of scan traffic)

Weaknesses:

• No service detection or OS fingerprinting (architectural limitation)
• Single-probe methodology (98% coverage, accepts 2% packet loss)
• IPv4-only design (IPv6 requires separate ZMapv6 with target generation)
• Manual memory management risks (C buffer overflows, use-after-free)
• Layer 4/Layer 7 gap (TCP liveness ≠ service presence)

ProRT-IP's Architecture

Language: Rust (memory-safe, zero-cost abstractions) Core Design: Hybrid stateful/stateless with async I/O and comprehensive detection

Key Innovations:

1. Tokio Async Runtime: Industry-standard non-blocking I/O, proven scalability
2. Hybrid Scanning Modes: Stateless (10M+ pps) for speed + Stateful (50K+ pps) for detection
3. Memory Safety: Compile-time guarantees (no buffer overflows, no use-after-free)
4. Event-Driven Architecture: Pub-sub system with -4.1% overhead
5. Rate Limiting V3: Industry-leading -1.8% overhead (bucket algorithm + adaptive throttling)

Strengths:

• Memory safety without performance penalty (Rust guarantees)
• Comprehensive detection (service versions, OS, TLS certificates) in single tool
• 8 scan types (flexibility for different scenarios)
• Cross-platform consistency (10M+ pps on Linux/Windows/macOS)
• Modern features (database storage, TUI, event system, plugin system)

Weaknesses:

• Maximum stateless speed 10M+ pps (vs ZMap 14.23 Mpps with PF_RING)
• Newer project (less field testing than ZMap's 11+ years, 500+ papers)
• No kernel bypass optimizations (standard async I/O only)

Use Cases

ZMap Excels At:

1. Internet-Wide TLS Certificate Surveys

# Scan entire IPv4 for port 443 in 42-45 minutes
zmap -p 443 -B 1G -o https-hosts.csv
cat https-hosts.csv | zgrab2 tls | zlint

# Academic study: 158 scans over 1 year
# Result: 33.6M unique X.509 certificates
# Discoveries: 1,832 browser-trusted CAs, misissued certificates

2. Vulnerability Assessment at Internet Scale

# UPnP vulnerability scan (entire IPv4 in under 2 hours)
zmap -p 1900 | zgrab2 upnp -o upnp-devices.json

# Heartbleed monitoring (scans every few hours)
zmap -p 443 | zgrab2 tls --heartbleed -o heartbleed-check.json

# Result: 15.7M publicly accessible UPnP devices
# Result: 3.4M vulnerable systems identified

3. Network Infrastructure Monitoring

# Hurricane Sandy impact assessment (continuous scans during storm)
while true; do
  zmap -p 80 -B 500M -o hosts-$(date +%Y%m%d-%H%M).csv
  sleep 3600  # Hourly scans
done

# Geographic mapping of >30% decrease in listening hosts
# Near real-time infrastructure assessment during disaster

4. Protocol Adoption Studies

# Random 0.05% sample across TCP ports 0-9175
for port in $(seq 0 9175); do
  zmap -p $port -n 0.05% -o port-$port.csv
done

# Discoveries: HTTP 1.77%, CWMP 1.12%, HTTPS 0.93%
# Unexpected: Port 7547 (CWMP), 3479 (2Wire RPC)

5. Distributed Internet Measurement

# Machine 1 (Google Cloud, us-central1)
zmap --shards 3 --shard 0 --seed 1234 -p 443 -B 500M -o shard-0.csv

# Machine 2 (AWS EC2, us-east-1)
zmap --shards 3 --shard 1 --seed 1234 -p 443 -B 500M -o shard-1.csv

# Machine 3 (Azure, westus2)
zmap --shards 3 --shard 2 --seed 1234 -p 443 -B 500M -o shard-2.csv

# Combines to single complete scan with geographic distribution

ProRT-IP Excels At:

1. Single-Pass Comprehensive Assessment

# Stateful scan with service detection + OS fingerprinting + TLS in one pass
prtip -sS -sV -O -p- 192.168.1.0/24 \
  --with-db --database comprehensive.db \
  -oX scan.xml -oJ scan.json

# No multi-tool pipeline needed (vs ZMap + ZGrab2 + LZR + ZLint)

2. Production Security Operations

#!/bin/bash
# Daily monitoring with change detection
DB="security-monitor.db"
TARGET="production.example.com"

prtip -sS -sV -p 22,80,443,3306,3389 $TARGET --with-db --database $DB

# Compare with previous scan
SCAN1=$(sqlite3 $DB "SELECT id FROM scans ORDER BY start_time DESC LIMIT 1 OFFSET 1;")
SCAN2=$(sqlite3 $DB "SELECT id FROM scans ORDER BY start_time DESC LIMIT 1;")

if prtip db compare $DB $SCAN1 $SCAN2 | grep -q "New Open Ports"; then
  echo "ALERT: New services detected!" | mail -s "Security Alert" soc@company.com
fi

3. Cross-Platform Enterprise Scanning

# Linux workstation
prtip -sS -sV -p- 192.168.1.0/24 --with-db --database linux-scan.db

# Windows workstation (same performance characteristics)
prtip.exe -sS -sV -p- 192.168.1.0/24 --with-db --database windows-scan.db

# macOS workstation (same performance characteristics)
prtip -sS -sV -p- 192.168.1.0/24 --with-db --database macos-scan.db

# Consistent 10M+ pps stateless on all platforms (vs ZMap platform variations)

4. Real-Time TUI Monitoring

# Interactive scan visualization at 60 FPS
prtip --live -sS -sV -p- 192.168.1.0/24

# TUI Features:
# - Port Table: Interactive list with sorting/filtering
# - Service Table: Detected services with versions
# - Metrics Dashboard: Real-time throughput, progress, ETA
# - Network Graph: Time-series visualization of activity

5. Bug Bounty / Penetration Testing

# Phase 1: Stateless rapid discovery (ZMap-class speed)
prtip --stateless -p 80,443,8080,8443 --max-rate 10000000 bug-bounty-scope.txt -oJ rapid.json

# Phase 2: Stateful enumeration with detection
prtip -sS -sV -A -p- discovered-hosts.txt --with-db --database pentest.db

# Phase 3: Query interesting services
prtip db query pentest.db --service apache
prtip db query pentest.db --port 8080

Migration Guide

Migrating from ZMap to ProRT-IP

What You Gain:

Service Detection (85-90% accuracy with 500+ service database) OS Fingerprinting (Nmap database compatible, 2,600+ signatures) TLS Certificate Analysis (X.509v3, chain validation, SNI support) Multiple Scan Types (8 types vs ZMap's SYN/ICMP/UDP basic) Memory Safety (Rust compile-time guarantees vs C manual memory) Modern Features (database storage, TUI, event system, plugin system) Single-Tool Solution (no ZGrab2/LZR/ZLint pipeline orchestration)

What You Keep:

High-Speed Stateless Scanning (10M+ pps, comparable to ZMap gigabit 1.44 Mpps) Randomized Address Order (prevents network saturation) Minimal Memory Footprint (stateless mode negligible overhead) Cross-Platform Support (Linux, Windows, macOS, FreeBSD) Pause/Resume Capability (checkpoint-based state preservation)

What Changes:

Maximum Speed (10M+ pps vs ZMap 14.23 Mpps with 10 GigE + PF_RING ZC) Methodology (hybrid stateful/stateless vs pure stateless) Ecosystem (single integrated tool vs ZMap + ZGrab2 + LZR pipeline) Sharding (manual target splitting vs ZMap's built-in --shards/--shard/--seed) Research Focus (production security vs academic Internet measurement)

Migration Steps:

1. Install ProRT-IP

# Linux
wget https://github.com/doublegate/ProRT-IP/releases/download/v0.5.0/prtip-x86_64-linux.tar.gz
tar xzf prtip-x86_64-linux.tar.gz
sudo mv prtip /usr/local/bin/
sudo setcap cap_net_raw,cap_net_admin=eip /usr/local/bin/prtip

2. Test Familiar ZMap-Style Commands

# ZMap: Internet-wide port 443 scan
zmap -p 443 -B 1G -o https-hosts.csv

# ProRT-IP: Equivalent stateless scan
prtip --stateless -p 443 --max-rate 10000000 0.0.0.0/0 -oJ https-hosts.json

3. Leverage Single-Tool Detection Advantage

# ZMap: Two-phase workflow (Layer 4 + Layer 7)
zmap -p 443 | ztee results.csv | zgrab2 http > http-data.json

# ProRT-IP: Single-pass with integrated detection
prtip -sS -sV -p 443 0.0.0.0/0 --with-db --database https-scan.db
prtip db query https-scan.db --service apache

4. Explore Database Features

# Run daily scans with change detection
prtip -sS -sV -p 22,80,443 critical-infrastructure.txt \
  --with-db --database monitoring.db

# Compare scans over time
prtip db compare monitoring.db 1 2
prtip db export monitoring.db --scan-id 1 --format json -o scan1.json

5. Integration Patterns

# Phase 1: ProRT-IP stateless (ZMap-class speed)
prtip --stateless -p 80,443 --max-rate 5000000 targets.txt -oJ rapid.json

# Phase 2: ProRT-IP stateful (comprehensive detection)
prtip -sS -sV -O -p- discovered-hosts.txt --with-db --database detailed.db

# Phase 3: Nmap deep inspection (optional)
nmap -sS -sV -sC --script vuln -iL interesting-hosts.txt -oX nmap-vuln.xml

Command Comparison

Basic Scanning

Performance Tuning

Detection

Output Formats

Distributed Scanning

Integration Workflows

ZMap Workflows

Internet-Wide TLS Survey with Analysis:

# Phase 1: Layer 4 discovery (ZMap, 42-45 minutes)
zmap -p 443 -B 1G -o https-hosts.csv

# Phase 2: Layer 7 interrogation (ZGrab2, hours to days)
cat https-hosts.csv | zgrab2 tls --timeout 10s -o tls-handshakes.json

# Phase 3: Certificate analysis (ZLint)
cat tls-handshakes.json | zlint -o certificate-validation.json

# Phase 4: Enrichment (ZAnnotate)
cat https-hosts.csv | zannotate --geoip2 --whois -o enriched-hosts.json

# Phase 5: Analysis (custom scripts)
python analyze-certificates.py certificate-validation.json > report.txt

Vulnerability Assessment Pipeline:

# Rapid UPnP discovery (ZMap + ZGrab2)
zmap -p 1900 | zgrab2 upnp -o upnp-devices.json

# Parse results and identify vulnerable versions
cat upnp-devices.json | jq -r 'select(.data.upnp.vulnerable == true) | .ip' > vulnerable-upnp.txt

# Integrate with vulnerability scanner
nmap -sV -sC --script upnp-info -iL vulnerable-upnp.txt -oX upnp-detail.xml

Continuous Monitoring with Censys:

# ZMap infrastructure powers Censys (4.3B IPv4 daily)
# Public API access instead of running scans

import censys.search
h = censys.search.CensysHosts()
query = h.search("services.service_name:APACHE", per_page=100, pages=1)

for page in query:
    for host in page:
        print(f"{host['ip']} - {host['services'][0]['service_name']}")

ProRT-IP Workflows

Single-Pass Comprehensive Security Assessment:

# Phase 1: Stateless rapid discovery (10M+ pps, ZMap-class)
prtip --stateless -p 80,443,8080,8443 --max-rate 10000000 \
  enterprise-network.txt -oJ rapid-discovery.json

# Phase 2: Stateful enumeration with detection (single tool)
prtip -sS -sV -O -p- discovered-hosts.txt \
  --with-db --database comprehensive.db \
  -oX scan.xml -oJ scan.json

# Phase 3: Query and analyze (built-in database)
prtip db query comprehensive.db --service apache
prtip db query comprehensive.db --port 8080 --open
prtip db export comprehensive.db --scan-id 1 --format csv -o report.csv

Continuous Security Monitoring with Change Detection:

#!/bin/bash
# Daily scans with automated alerting

DB="security-monitor.db"
TARGETS="critical-infrastructure.txt"

# Run comprehensive scan
prtip -sS -sV -p 22,23,80,443,3389 -iL $TARGETS \
  --with-db --database $DB

# Compare with previous scan
SCAN1=$(sqlite3 $DB "SELECT id FROM scans ORDER BY start_time DESC LIMIT 1 OFFSET 1;")
SCAN2=$(sqlite3 $DB "SELECT id FROM scans ORDER BY start_time DESC LIMIT 1;")

# Alert on changes
CHANGES=$(prtip db compare $DB $SCAN1 $SCAN2)
if echo "$CHANGES" | grep -q "New Open Ports"; then
  echo "$CHANGES" | mail -s "[ALERT] New Services Detected" soc@company.com
fi

Real-Time TUI Monitoring:

# Interactive scan visualization at 60 FPS
prtip --live -sS -sV -p- 192.168.1.0/24

# Keyboard shortcuts:
# Tab: Switch between Port Table, Service Table, Metrics, Network Graph
# ↑/↓: Navigate table rows
# s: Sort by column
# f: Filter results
# q: Quit

PCAPNG Packet Capture for Forensics:

# Capture all packets during scan for post-analysis
prtip -sS -sV -p- 192.168.1.0/24 \
  --pcapng scan-$(date +%Y%m%d-%H%M).pcapng \
  --with-db --database scan.db

# Analyze with Wireshark
wireshark scan-20250514-1230.pcapng

# Query database for correlation
prtip db query scan.db --target 192.168.1.100

Summary and Recommendations

Choose ZMap If:

✅ Internet-wide research surveys are the primary goal (42-45 min full IPv4 at gigabit) ✅ Academic network measurement (TLS certificate studies, protocol adoption, vulnerability tracking) ✅ Maximum speed with specialized hardware (14.23 Mpps at 10 GigE + PF_RING ZC) ✅ Horizontal scanning optimization (many hosts, single port) is the use case ✅ Mathematically rigorous randomization for statistical sampling required ✅ Two-phase workflow acceptable (ZMap Layer 4 + ZGrab2 Layer 7 separation) ✅ Censys integration valuable (4.3B IPv4 daily scans, public API access)

Choose ProRT-IP If:

✅ Single-pass comprehensive assessment required (service + OS + TLS in one tool) ✅ Detection capabilities critical (85-90% service accuracy, OS fingerprinting, TLS certificates) ✅ Production security operations (memory safety, error handling, database storage) ✅ Cross-platform consistency matters (10M+ pps on Linux/Windows/macOS) ✅ Multiple scan types needed (8 types: SYN, Connect, FIN, NULL, Xmas, ACK, UDP, Idle) ✅ Memory safety mandatory (Rust guarantees vs C manual memory) ✅ Modern features valuable (TUI, event system, plugin system, change detection)

Hybrid Approach

Phase 1: ProRT-IP Stateless Discovery (10M+ pps, ZMap gigabit-class speed)

prtip --stateless -p 80,443 --max-rate 10000000 enterprise-network.txt -oJ rapid.json

Phase 2: ProRT-IP Stateful Enumeration (50K+ pps with 85-90% detection)

prtip -sS -sV -O -p- discovered-hosts.txt --with-db --database comprehensive.db

Phase 3: Nmap Deep Inspection (optional, 100% accuracy, vulnerability scripts)

nmap -sS -sV -sC --script vuln -iL interesting-hosts.txt -oX vuln-scan.xml

Key Insight: ZMap's maximum speed advantage (14.23 Mpps vs ProRT-IP 10M+ pps) requires specialized 10 gigabit hardware with PF_RING Zero Copy kernel bypass. For standard gigabit deployments, ZMap achieves 1.44 Mpps while ProRT-IP stateless reaches 10M+ pps (~7x faster). ProRT-IP's integrated detection eliminates multi-tool pipeline orchestration (ZMap + ZGrab2 + LZR + ZLint) while maintaining comparable gigabit-class speeds.

Academic vs Production: ZMap optimizes for Internet-wide research (500+ papers, 33% of scan traffic) with mathematically rigorous randomization and proven stateless architecture. ProRT-IP targets production security assessments with comprehensive detection, memory safety, and single-tool simplicity. Choose based on use case: academic measurement (ZMap), production security (ProRT-IP), or hybrid approach (ProRT-IP stateless + ProRT-IP stateful + optional Nmap).

See Also

• ProRT-IP vs Nmap - Comparison with the gold standard scanner
• ProRT-IP vs Masscan - Comparison with the Internet-scale speed champion
• Technical Specification - ProRT-IP architecture details
• Performance Characteristics - Benchmarks and analysis
• ZMap Project - Official ZMap documentation
• Censys - Public Internet search powered by ZMap infrastructure