Efficient Application-Layer Scanning with Hybrid-State Lightweight TCP Stack for TLS-based Service Monitoring

Application-layer scanning is a widely used method for monitoring TLS-based services on the large-scale network for configuration and security. Existing application-layer scanners rely on default TCP protocol stacks designed for general scenarios and are limited on maximizing the utilization of hardware resources for high-speed scanning. To address the limitation, we propose a hybrid-state lightweight TCP working model(HLTCP) which combines stateful and stateless modes. HLTCP discards redundant features from mainstream TCP protocol stack implementations that are not suitable for high-speed scanning scenarios. It dynamically switches between stateful and stateless modes to minimize unnecessary state maintenance and transitions. We implement this model in an asynchronous scanner as a user-space protocol stack that makes it easily deployable. By providing custom interfaces for application-layer scanning probes, HLTCP can perform various TLS-based service scanning tasks. Our experiments demonstrate that the HLTCP scanner achieves at least 3.5 times the scanning efficiency of current state-of-the-art methods in terms of scan duration on common hardware configurations for TLS-based services in large-scale network, significantly improving the resource utilization rate in serive monitoring and network measurements.