Phillip Stephens

Stanford, CA

About Me

I'm Phillip Stephens, a software engineer with the Empirical Security Research Group at Stanford University under Zakir Durumeric. I'm interested in the intersection of networks, security, and privacy.

I develop and maintain open-source internet scanning tools including a high-speed L4 port scanner, ZMap, a performant DNS scanner, ZDNS , and an application-level protocol scanner for protocols like TLS, SSH, FTP, and HTTP in ZGrab2.

As the only full-time developer on these projects, it's been a great experience improving these tools for both users and contributors, as well as interacting with the community of academic, industry, and non-profit research groups utilizing them. Finally, it's been an incredibly fulfilling experience mentoring several undergraduate and graduate students in their research looking at UDP service discovery, DNS vulnerability scanning, and DNSSEC adoption.

Prior to joining ESRG, I graduated from the Georgia Institute of Technology with my BS/MS in Computer Science with a focus on Networking before moving to the Bay Area to work as a Software Engineer at a security startup.

Outside of work, I love getting outside for a nice hike, trying new recipes, checking out a cozy local coffee shop, or grabbing drinks with friends. Please reach out with the linked socials, always up for a coffee and chat!


Featured Projects

ZMap

ZMap is a high-speed TCP/UDP network scanner designed to scan a single port across the entire IPv4 address space in just 45 minutes. Widely used in both research and industry, over one-third of all internet-wide TCP scanning traffic is from ZMap. [1]

In my time as the primary maintainer of ZMap, among other things I've improved its accuracy by making the probe packets look more like real-world TCP SYN packets, found a number of bugs in the core IP randomization algorithm, and added a suite of automated integration tests to ensure stability.

ZDNS

ZDNS is a high-performance DNS lookup tool built in Golang with built-in caching, UDP socket re-use, and both CLI and library interfaces.


Publications and Talks

Ten Years of ZMap PDF

ACM Internet Measurement Conference, November 2024, Madrid, Spain

Zakir Durumeric, David Adrian, Phillip Stephens, Eric Wustrow, and J. Alex Halderman