Measure The Web

User Tools

Site Tools

Trace:
programming:internet_scanning

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
programming:internet_scanning [2026/09/17 02:09] – Hand audit of the 173 scan_fold HAND verdicts + ZMap/XMap reconciliation with design:dns; ACTIVE 245->242; 40 figures refreshed. Authored by Claude karel.kubicek.claudeprogramming:internet_scanning [2026/09/17 02:37] (current) – Review passes applied: Spoki's ZMap is a closed veth loop, so ACTIVE 242->241; fixed a 174/173 self-contradiction and a 46-vs-44 denominator. Authored by Claude karel.kubicek.claude
Line 15: Line 15:
 ^ Name ^ Definition ^ Papers ^ ^ Name ^ Definition ^ Papers ^
 | **SCAN** | ''studyTypes'' contains ''network-scan-or-probe'' — the branch population [[Design:Automated measurements]] routes with | **930** | | **SCAN** | ''studyTypes'' contains ''network-scan-or-probe'' — the branch population [[Design:Automated measurements]] routes with | **930** |
-| **ACTIVE** | names, as a tool it **used or produced**, an instrument //of active scanning//: an address-space scanner, a banner grabber, a reachability sweep, a remote censorship-probing platform, or an IPv6 target generator. Two edges of that rule are judgement calls, stated here rather than buried: a **censorship platform** (OONI, Censored Planet, Quack, Satellite — 23 papers) counts whether the paper ran the probes or re-analysed the platform's, because the platform //is// the instrument and the corpus rarely says which; and an **IPv6 target generator** counts although it sends nothing, because in IPv6 it is the step that decides what gets probed. Both are argued on [[provenance:programming:internet_scanning]] | **242** |+| **ACTIVE** | names, as a tool it **used or produced**, an instrument //of active scanning//: an address-space scanner, a banner grabber, a reachability sweep, a remote censorship-probing platform, or an IPv6 target generator. Two edges of that rule are judgement calls, stated here rather than buried: a **censorship platform** (OONI, Censored Planet, Quack, Satellite — 23 papers) counts whether the paper ran the probes or re-analysed the platform's, because the platform //is// the instrument and the corpus rarely says which; and an **IPv6 target generator** counts although it sends nothing, because in IPv6 it is the step that decides what gets probed. Both are argued on [[provenance:programming:internet_scanning]] | **241** |
  
-**ACTIVE** is this page's population and it is a **floor**, not a census. It is decided by the instrument, not by the extractor's ''tools[].category'': a scanner filed under ''other'' or ''infrastructure'' still counts (that rule adds **14** papers). But one-off names are only hand-read inside ''category == "network-scanner"'', so a paper that scanned and named its scanner something unique under some other category is missed. **233** of the 242 are inside SCAN; the other **9** scanned without being tagged as a scan study.+**ACTIVE** is this page's population and it is a **floor**, not a census. It is decided by the instrument, not by the extractor's ''tools[].category'': a scanner filed under ''other'' or ''infrastructure'' still counts (that rule adds **14** papers). But one-off names are only hand-read inside ''category == "network-scanner"'', so a paper that scanned and named its scanner something unique under some other category is missed. **232** of the 241 are inside SCAN; the other **9** scanned without being tagged as a scan study.
  
-The gap between the two numbers is itself a result. **534 of the 930 SCAN papers (57.4%) never name a ''network-scanner'' tool at all**, and 416 (44.7%) name no instrument this page's fold recognises anywhere in ''tools[]''. Some of those queried a dataset rather than scanning; some scanned and did not say with what. The fold, its 174 hand verdicts and the full residue are on [[provenance:programming:internet_scanning]].+The gap between the two numbers is itself a result. **534 of the 930 SCAN papers (57.4%) never name a ''network-scanner'' tool at all**, and 416 (44.7%) name no instrument this page's fold recognises anywhere in ''tools[]''. Some of those queried a dataset rather than scanning; some scanned and did not say with what. The fold, its 173 hand verdicts and the full residue are on [[provenance:programming:internet_scanning]].
  
 ===== Which instrument ===== ===== Which instrument =====
  
-Folded families over the 242 ACTIVE papers. The share column is of ACTIVE, and a paper can name several.+Folded families over the 241 ACTIVE papers. The share column is of ACTIVE, and a paper can name several.
  
-^ Family ^ What it does ^ Papers ^ Share of 242 ^ Spellings in the corpus ^ +^ Family ^ What it does ^ Papers ^ Share of 241 ^ Spellings in the corpus ^ 
-| **ZMap** | stateless IPv4 address-space scanner: sends one probe per target and keeps no per-connection state, so a single machine can walk the whole space. IPv6 comes from forks and successors — the ''ZMap6''/''ZMapv6'' spellings in the corpus are one of them | **95** | 39.3% | 10 | +| **ZMap** | stateless IPv4 address-space scanner: sends one probe per target and keeps no per-connection state, so a single machine can walk the whole space. IPv6 comes from forks and successors — the ''ZMap6''/''ZMapv6'' spellings in the corpus are one of them | **94** | 39.0% | 10 | 
-| nmap | host and service discovery on a target list; keeps per-target state and does far more per host, so it does not scale to the address space — see the 1300x figure below | 45 | 18.6% | 10 | +| nmap | host and service discovery on a target list; keeps per-target state and does far more per host, so it does not scale to the address space — see the 1300x figure below | 45 | 18.7% | 10 | 
-| **ZGrab / ZGrab2** | application-layer follow-up: opens its own connection to the hosts ZMap found (ZMap itself is stateless and RSTs), completes the protocol handshake and records the transcript | **32** | 13.2% | 7 | +| **ZGrab / ZGrab2** | application-layer follow-up: opens its own connection to the hosts ZMap found (ZMap itself is stateless and RSTs), completes the protocol handshake and records the transcript | **32** | 13.3% | 7 | 
-| //a home-grown scanner// | the paper wrote its own, or called it "a custom scanner" | 25 | 10.3% | 21 | +| //a home-grown scanner// | the paper wrote its own, or called it "a custom scanner" | 25 | 10.4% | 21 | 
-| ping / fping / hping | reachability sweeps | 18 | 7.4% | 7 |+| ping / fping / hping | reachability sweeps | 18 | 7.5% | 7 |
 | **XMap** | ZMap-family scanner built for IPv6 as well as IPv4 | **16** | 6.6% | 3 | | **XMap** | ZMap-family scanner built for IPv6 as well as IPv4 | **16** | 6.6% | 3 |
-| TLS banner grabbers | sslscan, sslyze, testssl.sh, TLS-Scanner, TLS-Crawler | 11 | 4.5% | 8 |+| TLS banner grabbers | sslscan, sslyze, testssl.sh, TLS-Scanner, TLS-Crawler | 11 | 4.6% | 8 |
 | OONI | volunteer-run censorship measurement | 7 | 2.9% | 3 | | OONI | volunteer-run censorship measurement | 7 | 2.9% | 3 |
 | Geneva | evolves packet sequences that evade a censor | 6 | 2.4% | 1 | | Geneva | evolves packet sequences that evade a censor | 6 | 2.4% | 1 |
Line 40: Line 40:
 | Goscanner, LZR, QScanner, Karma | Go and QUIC grabbers, IoT scanners | 2 each | | | | Goscanner, LZR, QScanner, Karma | Go and QUIC grabbers, IoT scanners | 2 each | | |
  
-**Thirty-seven more families are named by exactly one paper each** — but only **20** of those are a tool the paper itself //produced//; the other 17 are third-party tools that happen to appear once (''nc'', ''ike-scan'', ''smbmap'', ''JARM'', ''WhatWeb'' and the like). Those 20 home-grown ones plus the 25 papers whose scanner is only ever called "a custom scanner", minus the 5 that are both, give **45 of 242 (18.6%) that rolled their own**. That is the scanning analogue of the home-grown-crawler row on [[Programming:Crawler]].+**Thirty-seven more families are named by exactly one paper each** — but only **20** of those are a tool the paper itself //produced//; the other 17 are third-party tools that happen to appear once (''nc'', ''ike-scan'', ''smbmap'', ''JARM'', ''WhatWeb'' and the like). Those 20 home-grown ones plus the 25 papers whose scanner is only ever called "a custom scanner", minus the 5 that are both, give **45 of 241 (18.7%) that rolled their own**. That is the scanning analogue of the home-grown-crawler row on [[Programming:Crawler]].
  
 <WRAP tip> <WRAP tip>
Line 46: Line 46:
 </WRAP> </WRAP>
  
-**These counts are corpus-wide, and they agree with [[Design:DNS]].** ZMap and XMap are one family there and two here, so that page reports **111 papers** where this one reports 95 + 16; the sets are identical, and so are the two pages' 32 for ZGrab. They did not always agree — until 2026-09-17 this page said 95 + 16 = 111 against that page's 112, and the whole gap was **one** CCS 2016 paper whose ''tools[]'' entry is the single compound string ''%%ZGrab/ZMap%%'', which two ordered first-match-wins folds sent to different families. It was not an overlap artefact: **no paper in the corpus names both ZMap and XMap**. Both folds now split that one hand-read string, and ''scripts/reconcile_zmap.mjs'' fails if the two ever diverge again or if a new compound name appears whose parts a fold loses.+**These counts are corpus-wide, and they agree with [[Design:DNS]].** ZMap and XMap are one family there and two here, so that page reports **110 papers** where this one reports 94 + 16; the sets are identical, and so are the two pages' 32 for ZGrab. They did not always agree — until 2026-09-17 this page said 95 + 16 = 111 against that page's 112, and the whole gap was **one** CCS 2016 paper whose ''tools[]'' entry is the single compound string ''%%ZGrab/ZMap%%'', which two ordered first-match-wins folds sent to different families. It was not an overlap artefact: **no paper in the corpus names both ZMap and XMap**. Both folds now split that one hand-read string, and ''scripts/reconcile_zmap.mjs'' fails if the two ever diverge again or if a new compound name appears whose parts a fold loses.
  
 ==== Current, historical, superseded — dated 2026-09-10 ==== ==== Current, historical, superseded — dated 2026-09-10 ====
Line 56: Line 56:
 | 2014–2017 | 45 | 27 (60.0%) | 4 (8.9%) | 8 (17.8%) | 0 | 1 | 7 (15.6%) | | 2014–2017 | 45 | 27 (60.0%) | 4 (8.9%) | 8 (17.8%) | 0 | 1 | 7 (15.6%) |
 | 2018–2021 | 55 | 21 (38.2%) | 9 (16.4%) | 15 (27.3%) | 0 | 0 | 5 (9.1%) | | 2018–2021 | 55 | 21 (38.2%) | 9 (16.4%) | 15 (27.3%) | 0 | 0 | 5 (9.1%) |
-| 2022–2024 | 86 | 25 (29.1%) | 9 (10.5%) | 13 (15.1%) | 10 (11.6%) | 3 | 6 (7.0%) |+| 2022–2024 | 85 | 24 (28.2%) | 9 (10.6%) | 13 (15.3%) | 10 (11.8%) | 3 | 6 (7.1%) |
 | 2025–2026* | 44 | 21 (47.7%) | 10 (22.7%) | 4 (9.1%) | 6 (13.6%) | 0 | 4 (9.1%) | | 2025–2026* | 44 | 21 (47.7%) | 10 (22.7%) | 4 (9.1%) | 6 (13.6%) | 0 | 4 (9.1%) |
  
Line 63: Line 63:
   * **Masscan is historical in this corpus.** Four papers, none after 2024, and its newest GitHub Release is **1.3.2, from 2021-01-31** (the repository is not archived and was pushed 2026-04-23). {[durumeric2024_years]} also relays a measured reason to prefer ZMap, from Adrian et al.: //"Masscan […] finds notably fewer hosts than ZMap, likely due to biases in its randomization algorithm"//.   * **Masscan is historical in this corpus.** Four papers, none after 2024, and its newest GitHub Release is **1.3.2, from 2021-01-31** (the repository is not archived and was pushed 2026-04-23). {[durumeric2024_years]} also relays a measured reason to prefer ZMap, from Adrian et al.: //"Masscan […] finds notably fewer hosts than ZMap, likely due to biases in its randomization algorithm"//.
   * **XMap is the newcomer, and it is an IPv6 story.** Sixteen papers, **all of them 2023 or later**, 6 in the provisional window. It exists because the ZMap design does not extend to a 128-bit address space unchanged.   * **XMap is the newcomer, and it is an IPv6 story.** Sixteen papers, **all of them 2023 or later**, 6 in the provisional window. It exists because the ZMap design does not extend to a 128-bit address space unchanged.
-  * **Rolling your own has not gone away** — 4 of the 46 papers in the provisional window still do — but it has fallen from a quarter of the earliest bucket to under a tenth.+  * **Rolling your own has not gone away** — 4 of the 44 papers in the provisional window still do — but it has fallen from a quarter of the earliest bucket to under a tenth.
  
 ===== The invocation a reviewer accepts ===== ===== The invocation a reviewer accepts =====
Line 145: Line 145:
 The wire-rate column assumes **84 bytes of wire time per probe** — a bare TCP SYN is 54 bytes, ZMap's default ''synscan'' module sends no TCP options, and the frame is padded to the 60-byte Ethernet minimum, plus FCS, preamble and interframe gap. If your probe module sends a larger packet, say so and rerun the arithmetic; the script takes the assumption as a named constant you can see and change. The wire-rate column assumes **84 bytes of wire time per probe** — a bare TCP SYN is 54 bytes, ZMap's default ''synscan'' module sends no TCP options, and the frame is padded to the 60-byte Ethernet minimum, plus FCS, preamble and interframe gap. If your probe module sends a larger packet, say so and rerun the arithmetic; the script takes the assumption as a named constant you can see and change.
  
-**What the literature reports.** Two probes over the 242 ACTIVE papers' full text, both upper bounds: a loose regex for any rate or bandwidth term matches **125 (51.7%)**, and a first-person one requiring "we"/"our" near the term matches **82 (33.9%)**. Reading a pinned 12-paper sample of that second list, **5 of 12** are actually about the authors' own probe rate — the rest are a target's ICMP rate limiting, a censor's throttling, a lab attack rate, or a defence being recommended. So the honest estimate is **about 34 papers, roughly one in seven**, state the rate they scanned at. The ones that do are unambiguous about it: //"a low scanning rate of 10,000 packets per second, total, across all networks"// {[williams2024_6sense]}; //"a low probing rate of 8,000 packets per second, i.e., around 500KB/s from a single vantage point"// {[holzbauer2025_tracking]}.+**What the literature reports.** Two probes over the 241 ACTIVE papers' full text, both upper bounds: a loose regex for any rate or bandwidth term matches **124 (51.5%)**, and a first-person one requiring "we"/"our" near the term matches **81 (33.6%)**. Reading a pinned 12-paper sample of that second list, **5 of 12** are actually about the authors' own probe rate — the rest are a target's ICMP rate limiting, a censor's throttling, a lab attack rate, or a defence being recommended. So the honest estimate is **about 34 papers, roughly one in seven**, state the rate they scanned at. The ones that do are unambiguous about it: //"a low scanning rate of 10,000 packets per second, total, across all networks"// {[williams2024_6sense]}; //"a low probing rate of 8,000 packets per second, i.e., around 500KB/s from a single vantage point"// {[holzbauer2025_tracking]}.
  
 <file python scan_budget.py> <file python scan_budget.py>
Line 392: Line 392:
 {[durumeric2024_years]}'s own recommendation is explicit about both halves: //"Provide a simple mechanism for operators to request exclusion from future scans. Indicate the IP ranges you use for scanning so that operators can drop research traffic themselves."// {[durumeric2024_years]}'s own recommendation is explicit about both halves: //"Provide a simple mechanism for operators to request exclusion from future scans. Indicate the IP ranges you use for scanning so that operators can drop research traffic themselves."//
  
-**How rare is this?** The loose blocklist probe fires on **104 of 242 ACTIVE papers (43.0%)** and the first-person one on **89 (36.8%)**, but hand-reading a 12-paper sample of the latter gives **6 of 12** — the other six are a censor's blocklist, a threat-intelligence feed used as input data, or an analysis-time exclusion. Estimate: **about 45 papers, roughly one in five**. The opt-out probe is tighter and cleaner: **70 papers (28.9%)** match a first-person opt-out pattern and **9 of a 10-paper sample** are genuine, giving **about 63 papers, one in four**.+**How rare is this?** The loose blocklist probe fires on **103 of 241 ACTIVE papers (42.7%)** and the first-person one on **88 (36.5%)**, but hand-reading an 11-paper sample of the latter gives **6 of 11** — the other five are a censor's blocklist, a threat-intelligence feed used as input data, or an analysis-time exclusion. Estimate: **about 48 papers, roughly one in five**. The opt-out probe is tighter and cleaner: **70 papers (29.0%)** match a first-person opt-out pattern and **9 of a 10-paper sample** are genuine, giving **about 63 papers, one in four**.
  
 Two figures worth carrying. Durumeric et al. {[durumeric2014_view]} report that after years of running the largest academic scanning operation of its day, //"only 208 organizations have requested that we exclude their networks from our scans, reducing the IPv4 address space for study by only 0.15%"//. And Beverly et al. {[beverly2018_beholder]}, on a run of IPv6 topology campaigns between February and May 2018: //"we received two opt-out requests with which we immediately complied"//. The opt-out volume is small. That is an argument for offering it, not against. Two figures worth carrying. Durumeric et al. {[durumeric2014_view]} report that after years of running the largest academic scanning operation of its day, //"only 208 organizations have requested that we exclude their networks from our scans, reducing the IPv4 address space for study by only 0.15%"//. And Beverly et al. {[beverly2018_beholder]}, on a run of IPv6 topology campaigns between February and May 2018: //"we received two opt-out requests with which we immediately complied"//. The opt-out volume is small. That is an argument for offering it, not against.
Line 409: Line 409:
 {[durumeric2015_search]} describes exactly this for Censys' own infrastructure: //"All of the scanning hosts have WHOIS records and reverse DNS entries that describe the intent of the scanning. Further, each scanning host runs a simple website on port 80 that describes the goals of the research"//. {[kaspereit2024_landscape]} adds the people almost nothing in the corpus mentions — your own operators: //"On the scanning IPs, a website gives project details and contact information for opt-out requests. We honored all such requests. Our ISP, national CERT, and university network administrator cleared all scans."// Telling your own network operations team **before** the scan is the difference between a conversation and a ticket. {[durumeric2015_search]} describes exactly this for Censys' own infrastructure: //"All of the scanning hosts have WHOIS records and reverse DNS entries that describe the intent of the scanning. Further, each scanning host runs a simple website on port 80 that describes the goals of the research"//. {[kaspereit2024_landscape]} adds the people almost nothing in the corpus mentions — your own operators: //"On the scanning IPs, a website gives project details and contact information for opt-out requests. We honored all such requests. Our ISP, national CERT, and university network administrator cleared all scans."// Telling your own network operations team **before** the scan is the difference between a conversation and a ticket.
  
-**In the corpus**: the loose source-address probe matches **168 of 242 (69.4%)** and the first-person one **113 (46.7%)**, with **6 of a 10-paper sample** genuine — about **68 papers, a little over a quarter**, describe any of this. Abuse-complaint handling is discussed by **45 (18.6%)** on the first-person probe (upper bound; no precision measured). Two more probes, both loose and neither hand-audited, so read them as upper bounds and not against each other: **55 (22.7%)** match an IRB / ethics-board pattern and **173 (71.5%)** cite Durumeric, Partridge and Allman, the Menlo Report, or the phrase "good Internet citizen". Do **not** read the 55 as "only 55 had ethics review": the extraction's own ''ethics.reviewOutcome'' field is stated on **92 (38.0%)** of the same 242 papers, and that is the number to quote.+**In the corpus**: the loose source-address probe matches **167 of 241 (69.3%)** and the first-person one **112 (46.5%)**, with **6 of a 10-paper sample** genuine — about **67 papers, a little over a quarter**, describe any of this. Abuse-complaint handling is discussed by **45 (18.7%)** on the first-person probe (upper bound; no precision measured). Two more probes, both loose and neither hand-audited, so read them as upper bounds and not against each other: **55 (22.8%)** match an IRB / ethics-board pattern and **172 (71.4%)** cite Durumeric, Partridge and Allman, the Menlo Report, or the phrase "good Internet citizen". Do **not** read the 55 as "only 55 had ethics review": the extraction's own ''ethics.reviewOutcome'' field is stated on **92 (38.2%)** of the same 241 papers, and that is the number to quote.
  
 <WRAP tip> <WRAP tip>
Line 427: Line 427:
 ^ Query ^ Population ^ Papers ^ Share ^ ^ Query ^ Population ^ Papers ^ Share ^
 | mentions IPv6 anywhere | SCAN 930 | 281 | 30.2% | | mentions IPv6 anywhere | SCAN 930 | 281 | 30.2% |
-| mentions IPv6 anywhere | ACTIVE 242 | 108 | 44.6% |+| mentions IPv6 anywhere | ACTIVE 241 | 107 | 44.4% |
 | names an IPv6-targeting instrument in ''tools[]'' | SCAN 930 | **11** | 1.2% | | names an IPv6-targeting instrument in ''tools[]'' | SCAN 930 | **11** | 1.2% |
 | full text says "hitlist" / "hit list" | SCAN 930 | 62 | 6.7% | | full text says "hitlist" / "hit list" | SCAN 930 | 62 | 6.7% |
Line 442: Line 442:
 ZMap hands you a column of source addresses. That is not a result, and the step that turns it into one is where scanning papers most often overreach. ZMap hands you a column of source addresses. That is not a result, and the step that turns it into one is where scanning papers most often overreach.
  
-  * **An address is not an organisation.** The [[Design:IP classification]] page exists for the join — ASN, geolocation, network type, hosting vs eyeball, reputation. **76 of the 242 ACTIVE papers (31.4%)** carry a ''classification'' tuple whose target is ''ip-address'', against 22.9% of SCAN and 5.0% of the corpus; the raw resource names they reach for are 113 distinct free-text strings, led by MaxMind and IPinfo. Fold them before you count anything — that page publishes the fold.+  * **An address is not an organisation.** The [[Design:IP classification]] page exists for the join — ASN, geolocation, network type, hosting vs eyeball, reputation. **75 of the 241 ACTIVE papers (31.1%)** carry a ''classification'' tuple whose target is ''ip-address'', against 22.9% of SCAN and 5.0% of the corpus; the raw resource names they reach for are 110 distinct free-text strings, led by MaxMind and IPinfo. Fold them before you count anything — that page publishes the fold.
   * **An address is not a name.** Reverse DNS is not injective and is often absent; a certificate's SAN list, a Host header or a hitlist's provenance are usually better joins than a PTR.   * **An address is not a name.** Reverse DNS is not injective and is often absent; a certificate's SAN list, a Host header or a hitlist's provenance are usually better joins than a PTR.
   * **A responding address is not a distinct machine.** In IPv6 this is aliasing, above. In IPv4 it is anycast, load balancers and CDNs: the same content answers from thousands of addresses, and "N hosts run X" quietly becomes "N addresses answered".   * **A responding address is not a distinct machine.** In IPv6 this is aliasing, above. In IPv4 it is anycast, load balancers and CDNs: the same content answers from thousands of addresses, and "N hosts run X" quietly becomes "N addresses answered".
Line 450: Line 450:
 ===== What to report ===== ===== What to report =====
  
-The methods paragraph a reviewer should be able to find, and how often the 242 ACTIVE papers actually contain each part. Schema fields are counted from the extraction; probe rows are the hand-corrected estimates from the sections above and are marked.+The methods paragraph a reviewer should be able to find, and how often the 241 ACTIVE papers actually contain each part. Schema fields are counted from the extraction; probe rows are the hand-corrected estimates from the sections above and are marked.
  
-^ What ^ ACTIVE (242) ^ SCAN (930) ^+^ What ^ ACTIVE (241) ^ SCAN (930) ^
 | The **scanner and its version** — version of the scanner itself, not of some tool | **20 (8.3%)** | 20 (2.2%) | | The **scanner and its version** — version of the scanner itself, not of some tool | **20 (8.3%)** | 20 (2.2%) |
-| Any used-or-produced tool version at all | 116 (47.9%) | 401 (43.1%) | +| Any used-or-produced tool version at all | 115 (47.7%) | 401 (43.1%) | 
-| **Vantage location** you scanned from | 135 (55.8%) | 487 (52.4%) | +| **Vantage location** you scanned from | 134 (55.6%) | 487 (52.4%) | 
-| Vantage infrastructure (cloud, university, residential) | 165 (68.2%) | 612 (65.8%) |+| Vantage infrastructure (cloud, university, residential) | 164 (68.0%) | 612 (65.8%) |
 | **Probe rate** //(probe estimate)// | ~34 (~14%) | — | | **Probe rate** //(probe estimate)// | ~34 (~14%) | — |
-| **Exclusion list honoured** //(probe estimate)// | ~45 (~19%) | — |+| **Exclusion list honoured** //(probe estimate)// | ~48 (~20%) | — |
 | **Opt-out offered** //(probe estimate)// | ~63 (~26%) | — | | **Opt-out offered** //(probe estimate)// | ~63 (~26%) | — |
-| **Source-address hygiene** //(probe estimate)// | ~68 (~28%) | — | +| **Source-address hygiene** //(probe estimate)// | ~67 (~28%) | — | 
-| Ethics review outcome | 92 (38.0%) | 290 (31.2%) | +| Ethics review outcome | 92 (38.2%) | 290 (31.2%) | 
-| Notified affected parties | 184 (76.0%) | 560 (60.2%) | +| Notified affected parties | 184 (76.3%) | 560 (60.2%) | 
-| Harm mitigation described | 209 (86.4%) | 700 (75.3%) | +| Harm mitigation described | 208 (86.3%) | 700 (75.3%) | 
-| Measurement start date | 193 (79.8%) | 656 (70.5%) | +| Measurement start date | 192 (79.7%) | 656 (70.5%) | 
-| Own artifact URL | 145 (59.9%) | 506 (54.4%) |+| Own artifact URL | 144 (59.8%) | 506 (54.4%) |
  
 **Eight per cent name the version of the scanner they ran.** That is the worst row on the table and the easiest to fix: ZMap's behaviour has changed materially inside the version range this corpus covers — {[durumeric2024_years]} records that //"In early 2024, ZMap changed its default behavior to use random per-probe IP IDs"//, which is exactly the kind of change that moves an IP-ID side-channel result — and ''%%zmap --version%%'' costs nothing. Also add: your **port set**, your **seed**, your **probes-per-target**, the **wall-clock span** (''temporal.spanStart'' is missing on a fifth of ACTIVE papers), and, for IPv6, **which hitlist snapshot and whether you de-aliased**. **Eight per cent name the version of the scanner they ran.** That is the worst row on the table and the easiest to fix: ZMap's behaviour has changed materially inside the version range this corpus covers — {[durumeric2024_years]} records that //"In early 2024, ZMap changed its default behavior to use random per-probe IP IDs"//, which is exactly the kind of change that moves an IP-ID side-channel result — and ''%%zmap --version%%'' costs nothing. Also add: your **port set**, your **seed**, your **probes-per-target**, the **wall-clock span** (''temporal.spanStart'' is missing on a fifth of ACTIVE papers), and, for IPv6, **which hitlist snapshot and whether you de-aliased**.
Line 498: Line 498:
 ===== Methodology and limitations of these figures ===== ===== Methodology and limitations of these figures =====
  
-Every number above is a count of **papers**, from the 5,859-paper extraction, with its denominator in the same sentence or table header. Sentinels (''not-stated'', ''none-mentioned'') are never counted as answers, and an absent ''ethics'' or ''artifacts'' object is counted as neither (7 and 3 ACTIVE papers). Free-text instrument names are folded before counting: the fold is ''scripts/scan_fold.mjs'', it decides **742** used-or-produced ''network-scanner'' tuples with **zero** unmapped strings, and its 173 hand verdicts and full residue are published on the provenance page. ZMap alone appears under **10** spellings.+Every number above is a count of **papers**, from the 5,859-paper extraction, with its denominator in the same sentence or table header. Sentinels (''not-stated'', ''none-mentioned'') are never counted as answers, and an absent ''ethics'' or ''artifacts'' object is counted as neither (7 and 3 ACTIVE papers). Free-text instrument names are folded before counting: the fold is ''scripts/scan_fold.mjs'', it decides **741** used-or-produced ''network-scanner'' tuples with **zero** unmapped strings, and its 173 hand verdicts and full residue are published on the provenance page. ZMap alone appears under **10** spellings.
  
 Four limitations to carry: Four limitations to carry:
  
   * **ACTIVE is a floor.** A paper that scanned and named its scanner something unique outside ''tools[].category == "network-scanner"'' is not counted. The over-count risk is guarded rather than assumed: the ''ZMap'' regex ''%%/z-?map/i%%'' matches //WizMap//, an unrelated visualisation tool that appears in one paper, and the fold names and excludes it explicitly.   * **ACTIVE is a floor.** A paper that scanned and named its scanner something unique outside ''tools[].category == "network-scanner"'' is not counted. The over-count risk is guarded rather than assumed: the ''ZMap'' regex ''%%/z-?map/i%%'' matches //WizMap//, an unrelated visualisation tool that appears in one paper, and the fold names and excludes it explicitly.
-  * **The four practice rows are probe estimates on samples of 10–12.** Read "about a fifth", not "18.6%". The probes, the samples, the per-paper verdicts and the deciding sentence for each are on the provenance page.+  * **The four practice rows are probe estimates on samples of 10–12.** Read "about a fifth", not "19.9%". The probes, the samples, the per-paper verdicts and the deciding sentence for each are on the provenance page.
   * **''studyTypes'' is the least stable field in the schema** (57% run-to-run on a 100-paper sample, not re-measured on this corpus). SCAN = 930 is a ranking-grade number, so treat every //share of 930// as approximate. ACTIVE does not depend on it.   * **''studyTypes'' is the least stable field in the schema** (57% run-to-run on a 100-paper sample, not re-measured on this corpus). SCAN = 930 is a ranking-grade number, so treat every //share of 930// as approximate. ACTIVE does not depend on it.
-  * **The hand verdicts have been read once, by one reader.** All 173 were audited against each tool's ''purpose'' text and its paper's title and full text on 2026-09-17; five kinds changed, three of them taking a paper out of ACTIVE and one putting one in, and four tuples in a single network-telescope paper were suppressed because the paper fingerprinted the scanners rather than running them. ACTIVE moved from 245 to **242**. Every change, with its deciding sentence, is on the provenance page. A second reader would not agree with all of them — the borderlines are listed there too.+  * **The hand verdicts have been read once, by one reader.** All 173 were audited against each tool's ''purpose'' text and its paper's title and full text on 2026-09-17; five kinds changed, three of them taking a paper out of ACTIVE and one putting one in, and five tuples across two papers were suppressed — four because a network-telescope paper fingerprinted the scanners rather than running them, one because a ZMap run never left its own machine. ACTIVE moved from 245 to **241**. Every change, with its deciding sentence, is on the provenance page, and so is the review pass that checked them: it confirmed all five kind changes and all six borderlines against the papers, and found the fifth suppression, which this run had missed.
   * **2025–2026 venue-years are provisional** and the corpus is seven venues. Network-measurement work also appears at PAM, TMA, ANRW, CoNEXT and ACSAC, **none of which are in this corpus** — for scanning specifically that is a bigger gap than for the web pages on this site, and several instrument papers this literature leans on are published there. Do not take that as a claim about any specific tool above — Yarrp's own paper, for one, is IMC 2016 and //is// in this corpus.   * **2025–2026 venue-years are provisional** and the corpus is seven venues. Network-measurement work also appears at PAM, TMA, ANRW, CoNEXT and ACSAC, **none of which are in this corpus** — for scanning specifically that is a bigger gap than for the web pages on this site, and several instrument papers this literature leans on are published there. Do not take that as a claim about any specific tool above — Yarrp's own paper, for one, is IMC 2016 and //is// in this corpus.
  
programming/internet_scanning.txt · Last modified: by karel.kubicek.claude