# An Efficient Internet-Wide Scan Approach Based on Location Awareness
## 3 Considered Scenario and Motivation
### Motivation  
Distributed scanning frameworks such as DNmap and Scantron usually adopt a random task assignment strategy when performing large-scale network scanning tasks. This means that the central server receives a task and randomly selects a scanner to perform the corresponding scanning task. Although this strategy is more common in distributed systems, it has significant drawbacks, especially in terms of scanning efficiency. Experimental data shows that scanners usually perform more efficiently when scanning IP addresses in their home countries, while they are significantly less efficient when scanning IP addresses in other countries. This conclusion is fully verified in the experiments of this study, and this finding provides a strong basis for improving the task scheduling mechanism.  
The experimental results in Figure 2 clearly demonstrate the effectiveness of the location-aware model and further reveal the differences in scanning efficiency of scanning sources from different countries through visualisation charts. Different colours in the bar chart represent different countries (AU, GB, NL, JP, SG, US), while the horizontal coordinate is the target country and the vertical coordinate is the time required for scanning. As can be seen from the graph, the difference in scanning time between scanners from different sources when scanning the same target country is very significant. For example, in the task of scanning AU (Australia), scanners located in AU's home country took significantly less time than scanners from other countries, while scanners from GB (UK) took the longest time to complete the task. The reason behind this phenomenon is not entirely determined by physical distance. Although geographically AU was farther away from GB than other scanning sources, this factor did not fully explain the scanning time differences. For example, even though SG (Singapore) is physically closer to AU than NL (the Netherlands), US (United States), and JP (Japan), the scanning time of the SG scanner is longer than that of the scanners in these countries. This suggests that the scanning efficiency of a scanner is not only related to the physical distance but also closely related to the ease of network access between different countries. Specifically, JP's scanner is much smoother than SG's scanner in scanning AU's IP address, which may be related to factors such as the speed of cross-country data transfer.  
Therefore, how to achieve efficient task allocation and ensure load balancing among scanners while taking advantage of geographical location has become a major challenge to be solved, and the next section will delve into the scanning node task scheduling mechanism. Note that the geographic location we refer to is not the physical distance but the network connection distance; some countries are physically closer, but the physical connection goes through multiple routes and firewalls and therefore has a higher latency, so the geographic location refers to the network routing location, not the real physical  
Figure 1: Internet-wide scanning scenario.  
location. In addition, we recognise that differences in network routing within countries are not always negligible. However, in our experimental setup, we found that the scanning performance of major cities within the same country is essentially the same.  
Figure 2: Verification of location-aware experiments: (**a**) AU time used for scanning target countries; (**b**) GB time used for scanning target countries; (**c**) NL time used for scanning target countries; (**d**) JP time used for scanning target countries; (**e**) SG time used for scanning target countries; (**f**) US time used for scanning target countries. **Note**: Horizontal axis indicates target country being scanned, and vertical axis is average time used to scan network segment.