anonion0 / nsec3map

a tool to enumerate the resource records of a DNS zone using its DNSSEC NSEC or NSEC3 chain
GNU General Public License v3.0
181 stars 31 forks source link

Allow to auto-stop after N hashes generated #18

Closed BenBE closed 1 year ago

BenBE commented 1 year ago

A small (and likely easy to implement) idea I was recently missing was a command line flag where I can tell n3map to generate at most a given number of hashes (like 2^30) and terminate at the time latest even if the zone hasn't been fully enumerated yet.

This feature can be interesting if you are enumerating several zones in a batch run and want a somewhat "guaranteed" runtime for each zone.

anonion0 commented 1 year ago

Agreed. I wanted to add something along these lines at some point.

Similar options could be:

BenBE commented 1 year ago

Given that finding a hash inside a certain range is proportional to that range's size, you can estimate the number of (random) guesses by 2^-log(1-coverage). So if a quarter is currently still uncovered, you will likely be a random guess for that uncovered range in the next for guesses (not guaranteed, but with high probability).

This even could be used as a further termination option: Terminate if log(1 - coverage) / log(coverage / #RR) > X with X > 2 (i.e. if the remaining gap in the coverage is significantly smaller than the average gap covered by each found RR so far).

anonion0 commented 1 year ago

I decided to add an option --hashlimit=N to limit the # of hashes checked as you originally described. I may add more sophisticated termination options at some point, but I think for most scenarios this is probably sufficient.