FAQ

Q: Can multiple ZMap scans be run in parallel?

A: While ZMap does use a unique value per-host to determine what traffic is in response to a scan it initialized (and not background traffic/noise), it's not advised to run multiple scans on the same machine due to resource contention concerns.

Q: Will ZMap TCP SYN scans interfere with the OS's TCP stack?

A: ZMap's TCP SYN packets shouldn't interfere with the OS stack. We have our own internal network stack, but if there's a normal TCP connection, it'll just look like a spurious packet and both sides will ignore the other.

Q: Why is there such high CPU utilization with ZMap?

A: ZMap will start 1 thread for receiving packets, 1 for monitoring the overall state of the scan, and T for sending packets (default is min(4, number of cores on host), can be overridden with -T 8 or --sender-threads=8). By default, the threads are pinned to different cores to minimize CPU contention. The sending threads have by far the most work to do and will tend towards maxing out the core as they attempt to send packets as fast as the NIC will support. If you need to reduce the CPU load on your machine, lower the --sender-threads.