SNI Proxy ZMap Scans

zmap.sniproxy.20161024.csv.xz contains the ZMap CSV output of full TCP SYN scans of the IPv4 address against port 443, and contains the following fields: saddr, saddr_raw, daddr, daddr_raw, ipid,ttl, sport, dport, seqnum, acknum, window, classification, success, repeat, cooldown, timestamp_str, timestamp_ts, timestamp_us. scan-sniproxy.20161024.csv.xz contains the CSV output of a custom scan-sniproxy program, which connects to a TLS server using a specific SNI value and records a hash of the certificate returned by the server and any validation errors. The scan-sniproxy output has the following fields: date, target, host, port, sni, elapsed, is_sniproxy, spki_sha256, error. date is a timestamp and elapsed is the time elapsed start to finish for a particular server. target and host are both the IP address of the server (scan-sniproxy allows specifying a target by hostname; in that case the hostname would be in the target field and the IP address would be in the host field). port is always 443 in this dataset. sni is always "sni-scan-for-research-study.bamsoftware.com" in this dataset. is_sniproxy is "T" or "F". spki_sha256 is the SHA-256 hash of the certificate Subject Public Key Info, or blank in the case of a validation error. error is a validation error string, or blank. The value for spki_sha256 that indicates successful proxying is de15ef2559e770a3a283d632c94fe578f988c5768573a40caa28ff13cbd854d5. The file contains one false positive, 50.116.53.83, which was the actual IP address of sni-scan-for-research-study.bamsoftware.com. ; [e-mail]