scanssh(1)

NAME
scanssh - scans the Internet for SSH server versions

SYNOPSIS
scanssh [-VIERh] [-n port] [-e excludefile] [-p ifaddr] addresses...

DESCRIPTION
scanssh scans the given addresses and networks for running SSH servers. It will query their version number and displays the results in a list.

The adresses can be either specified as an IPv4 address or an CIDR like IP prefix, ipaddress/masklength. Additionally, the following two commands can be prefixed to the address:

random(n[,seed])/
    The random command selects random address from the address range specified. The arguments are as follows: n is the number of address to randomly create in the given network and seed is a seed for the pseudo random number generator.

split(s,e)/
    The split command is used to split the address range in several unique components. This can be use to scan from serveral hosts in parallel. The arguments are as follows: e specifies the number of hosts scanning in parallel and s is the number of the host this particular scan runs on.

The options are as follows:

-V  Causes scanssh to print its version number.

-I  Does not send an identification string. This causes the IP number of the scanning host to be logged.

-E  Exit the program, if the file containing the addresses for exclusion can not be found.

-R  If addresses are generated at random, this flag causes the program to ignore excluded addresses from the exclude file. The default behaviour is to always exclude addresses.

-h  Displays the usage of the program.

-n port
    Specifies the port number to scan. Currently, only 22 or 80 are supported. Port number 22 scans for SSH server versions and port number 80 scans for HTTP server versions. The default is 22.

-e excludefile
    Specifies the file that contains the addresses to be excluded from the scan. The syntax is the same as for the addresses on the command line.

-p ifaddr
    Specifies the address of the local interface. This is used to speed up the scanning by pre-probing the addresses with TCP-SYN packets.

The output from scanssh contains only IP addresses. However, the IP addresses can be converted to names with the logresolve(8) tool included in the Apache webserver.

EXAMPLES
The following command scans the class C network 10.0.0.0 - 10.0.0.255:

    scanssh 10.0.0.0/24

The next command uses SYN probes to speed up the scan

    scanssh -p 10.0.0.1 192.168.0.0/16

The following command can be used in a parallel scan. Two hosts scan the specified networks randomly, where this is the first host:

    scanssh -p 10.0.0.1 'random(0,rsd)/split(1,2)/(192.168.0.0/16 10.1.0.0/24)'

BUGS
At the moment, scanssh leaves a one line entry in the log file of the ssh server. It is probably not possible to avoid that.