Distributed scanning
A system for scanning a network includes an interface and a processor. The interface is configured to receive an indication to scan a set of network addresses. The processor is configured to determine a set of available scanning nodes and determine a job plan for scanning the set of network addresses using the set of available scanning nodes. The job plan includes one or more job portions. The processor is configured to, for a job portion of the one or more job portions, select a scanning node of the set of available scanning nodes and provide the job portion to the scanning node.
1. A method for scanning a network for devices associated with an organization, comprising:
determining a complete outside view of the network by:
receiving a request to scan the Internet with a network scanning controller for a set of network addresses for devices associated with the organization, where said devices have common organizational ownership or common network management, wherein said request to scan is for open ports on a device, services running on a device, device configuration information, device encryption information, and device network settings, the scan performed via the Internet from outside of the network via publicly accessible ports; and
said network scanning controller scanning the Internet by determining a set of available scanning nodes;
based on the requested scan and the set of available scanning nodes, said network scanning controller determining a job plan for scanning the set of network addresses by using the set of available scanning nodes to perform the scan, wherein the job plan comprises one or more job portions; and
for a job portion of the one or more job portions:
said network scanning controller selecting a scanning node of the set of available scanning nodes; and
said network scanning controller providing the job portion to the scanning node;
with each said scanning node, said network scanning controller performing a scan corresponding to said node's job portion; and
said network scanning controller creating a complete scan result for said network by combining results received from the scanning nodes for the scan corresponding to each said node's respective job portion.
2. The method of claim 1 , wherein the network scanning controller communicates with the scanning node via an anonymizing system.
3. The method of claim 1 , wherein a job portion of the one or more job portions comprises instructions to scan a portion of the set of network addresses.
4. The method of claim 1 , wherein a job portion of the one or more job portions comprises a set of ports.
5. The method of claim 1 , wherein a job portion of the one or more job portions comprises a set of scanning commands.
6. The method of claim 1 , wherein the scanning node is selected based at least in part on a job portion of the one or more job portions.
7. The method of claim 1 , wherein the scanning node is selected based at least in part on a physical location of the scanning node.
8. The method of claim 1 , wherein the scanning node is selected based at least in part on the scanning node having not been recently selected.
9. The method of claim 1 , wherein the scanning node is selected randomly or pseudorandomly.
10. The method of claim 1 , wherein the network scanning controller provides the job plan result to a database for storage.
11. The method of claim 1 , wherein the network scanning controller receives a scanning result from the scanning node.
12. The method of claim 11 , wherein the network scanning controller modifies the job plan based at least in part on a scanning result.
13. The method of claim 12 , wherein modifying the job plan comprises adding a reattempt of a scan of a job portion of the one or more job portions using one or more different scanning nodes.
14. The method of claim 12 , wherein modifying the job plan comprises adding one or more nearby scan locations to the job portion.
15. The method of claim 12 , wherein modifying the job plan comprises adding one or more follow-up scans to the job portion.
16. The method of claim 1 , wherein the set of available scanning nodes are implemented using cloud computing hardware.
17. The method of claim 1 , wherein the set of available scanning nodes are implemented using a different system than the system for scanning the network.
18. The method of claim 1 , wherein the set of available scanning nodes do not comprise publicly visible information for identifying their association with the system for scanning the network.