DeltaScanner

A standalone command-line SNI/IP scanner.

Features

• Two scan modes:
  • sni — DNS → TCP → TLS → HTTP (TTFB + download/upload speed) probes for every hostname in the SNI list.
  • ip — phase 1 TCP connect, pipelined into phase 2 TLS handshake + TTFB. The range list is walked in order; each pass picks one uniformly-random host from each range, and after the last range the scan loops back to the first. It runs forever until stopped (c), saving whatever was collected.
• Single progress line on stderr while scanning (suppressed when piped).
• Ranked results written to a result/ folder next to the executable as:
  • JSON — full structured results.
  • CSV — tabular results with a header row.
  • TXT — only the hostnames (SNI scan) or IPs (IP scan), one per line, ordered by score (best first), deduplicated.
• RESULTS_TOP_N limits how many of the top-ranked results are saved.

Requirements

• Rust 1.75+ (edition 2021).
• This project pins stable-x86_64-pc-windows-gnu via rust-toolchain.toml. On Windows, building with the MSVC toolchain requires the MSVC linker (link.exe); the GNU toolchain links through MSYS2's gcc/ld instead.

Build

cargo build --release

The binary is written to target/release/deltascanner.exe.

Check commands:

cargo test
cargo clippy --all-targets -- -D warnings
cargo fmt -- --check

Usage

Run the executable from the folder that contains config.toml (or pass --config). Relative paths in the config are resolved from the config file's directory.

On startup an interactive menu asks you to pick a scan:

> [1] IP test
  [2] SNI domain test

Select with the arrow keys + Enter, or press 1/2 directly. When stdin is piped (not a terminal), the menu is skipped and the IP scan runs by default.

Flag	Meaning
-c, --config	Path to config.toml (default: ./config.toml).
--timeout	Override all per-phase timeouts in seconds (DNS, TCP, TLS, TTFB, upload).
--list	Override the IP/SNI list path.
--dns-server	Enable custom DNS and use this plain DNS server (SNI scan).
--scan-sni	Override the SNI used for the TLS phase of the IP scan.

The SNI scan probes every hostname in the list once. The IP scan is infinite: it walks the range list in order, picking one uniformly-random host from each range per pass, loops back to the first range after the last one, and keeps going until stopped. During any scan, pressing c stops it and saves the partial results collected so far; the key listener is only active when stdin is a terminal.

After a scan stops, the ranked results are saved under result/{sni,ip}_results.{json,csv,txt} next to the executable. A progress line is drawn on stderr (it is suppressed when stderr is not a terminal).

Configuration

A reduced config. Only the fields the scanner engine touches are kept, with their defaults and validation.

LISTEN_HOST = "127.0.0.1"      # retained for schema compatibility; unused by the scanner
LISTEN_PORT = 44444            # retained for schema compatibility; unused by the scanner
SNI_LIST = "sni_list.txt"
IP_LIST = "ip_list.txt"

DNS_TIMEOUT_SECS = 5           # per-phase probe timeouts in seconds:
TCP_TIMEOUT_SECS = 5           #   DNS, TCP connect, TLS handshake,
TLS_TIMEOUT_SECS = 5           #   HTTP TTFB/download, upload speed test
TTFB_TIMEOUT_SECS = 5
UPLOAD_TIMEOUT_SECS = 5
CUSTOM_DNS_ENABLED = false     # resolve hostnames through CUSTOM_DNS_SERVER only
CUSTOM_DNS_SERVER = ""         # literal IP with optional port, e.g. "1.1.1.1:5353"
AUTO_SELECT = true             # pick the top-ranked entry after scanning
RESULTS_TOP_N = 100            # save only the top N ranked results; 0 = save all

IP_SCAN_SNI = "cloudflare.com" # SNI used during the TLS phase of IP scanning

# Concurrency tuning
SNI_MAX_CONCURRENT = 64
IP_MAX_P1_CONCURRENT = 128
IP_MAX_P2_CONCURRENT = 32

# Speed-test caps
SCAN_DOWNLOAD_CAP = 10240      # max bytes downloaded for speed tests
SCAN_UPLOAD_CAP = 10240        # max bytes uploaded for upload speed tests
SCAN_UPLOAD_PATH = "/"         # candidate-relative HTTP path used for upload tests

# Scoring caps (latency/speed values where each component reaches 0 or max pts)
TCP_LATENCY_CAP_MS = 500.0
TLS_LATENCY_CAP_MS = 1000.0
TTFB_CAP_MS = 2000.0
SPEED_CAP_BPS = 2048000.0
UPLOAD_SPEED_CAP_BPS = 2048000.0

# Scoring weights (max pts per component; 0 disables a component)
TCP_LATENCY_MAX_PTS = 25.0
TLS_SUCCESS_PTS = 10.0
TLS_LATENCY_MAX_PTS = 15.0
CERT_VALID_PTS = 5.0
TTFB_MAX_PTS = 20.0
DOWNLOAD_SPEED_MAX_PTS = 7.5
UPLOAD_SPEED_MAX_PTS = 7.5
ALL_PHASES_BONUS_PTS = 10.0

Project layout

Cargo.toml            package manifest
config.toml           sample configuration
sni_list.txt          candidate SNI hostnames (one per line)
ip_list.txt           candidate IPs / CIDR ranges (one per line)
rust-toolchain.toml   pinned toolchain
src/
  main.rs             CLI, progress bar, result-file writing
  config.rs           reduced config (scanner fields only)
  dns.rs              DNS resolver
  sni_scanner.rs      SNI scan pipeline
  ip_scanner.rs       IP scan pipeline
  scanner_http.rs     HTTP probe helpers

Note: the scanner modules are intentionally unmodified copies. Treat sni_scanner.rs, ip_scanner.rs, scanner_http.rs, and dns.rs as frozen; the CLI lives entirely in main.rs and config.rs.

License

MIT.