Scanning subnets

[michal-cech]

Hello, do you plan to add support for subnets? E.g. instead of preparing an input file with IPs covering the whole subnet we could pass something like 10.0.0.0/8.

[prbinu]

@michal-cech, thanks for reaching out. Based on the example you shared, it appears that you want to scan a large number of servers (16M).

I believe passing this large block into one tls-scan instance would be counter-productive, as tls-scan is basically a single-threaded program (by design). To extract the max performance, you need to break the large IP block into small chunks (say if you have 32 cores, then total ips / 31) and run multiple instance of tls-scan binary in parallel, and later merge the results using std Unix tools.

Also not to forget to tweak the port/fd/related kernel settings to get max performance.

Nevertheless, I think it would be a good feature to include in tls-scan. I will try to add this feature soon.