arsenal/masscan

masscan

mass IP port scanner · AGPL-3.0

An asynchronous port scanner that sweeps enormous address ranges in minutes, then hands the live hosts to nmap for the detailed work.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01Why masscan exists

nmap is thorough but sends packets and waits for each reply, which is slow across large ranges. masscan takes the opposite approach: it fires packets as fast as the link allows and matches replies asynchronously, with its own TCP/IP stack. The author describes it as able to scan the entire IPv4 internet in minutes from a fast connection. You do not use it instead of nmap; you use it to find the few live ports in a huge space, then point nmap at those.

↑ contents

02Install

$ sudo emerge net-analyzer/masscan # Gentoo

$ sudo apt install masscan # Debian / Ubuntu / Kali

$ sudo dnf install masscan # Fedora / RHEL

03A basic scan

The syntax looks like nmap on purpose, but the rate flag is the one that matters: it sets packets per second, and it is the dial between speed and politeness. Start low on anything shared. Running raw sockets needs root.

$ sudo masscan 10.0.0.0/24 -p80,443,22,8080 --rate 1000

04Sweeping all ports fast

To find anything listening anywhere, scan the full port range. This is where masscan earns its name; the same sweep in nmap would take far longer. Keep the rate sane so you do not melt a switch or trip an IDS.

$ sudo masscan 10.0.0.0/24 -p0-65535 --rate 5000 -oL sweep.txt

» Higher --rate is faster but drops more replies and is louder. On a home lab 1000-5000 is plenty; reserve big rates for links you own end to end.

05Excluding what you must not touch

On a real engagement there are addresses you are told to leave alone. masscan takes an exclude file, and honouring it is part of staying inside scope.

$ sudo masscan 10.0.0.0/16 -p443 --rate 2000 --excludefile scope-exclude.txt

↑ contents

06Output formats

masscan writes several machine-readable formats. The list format is human-readable; the grepable and JSON forms feed scripts; and there is a mode that emits nmap-style XML. Pick the one your next step wants.

$ sudo masscan 10.0.0.0/24 -p1-65535 --rate 3000 -oG masscan.gnmap

$ sudo masscan 10.0.0.0/24 -p1-65535 --rate 3000 -oJ masscan.json

07The classic masscan-then-nmap pipeline

This two-step is the point of the tool. masscan finds the open ports across the whole range quickly; then you feed just those hosts and ports to nmap for service and version detection, which is the slow part you only want to run where something is actually listening.

$ sudo masscan 10.0.0.0/24 -p1-65535 --rate 3000 -oL sweep.txt

$ awk '/open/{print $4}' sweep.txt | sort -u > live-hosts.txt

$ nmap -sV -iL live-hosts.txt

» Fast and wide first, slow and deep second. That split is how you scan a large space without waiting all day or hammering every host with full version detection.

↑ contents

08What a masscan sweep teaches the owner

Run masscan against your own range and the open-port list is your external attack surface at a glance: every service exposed, including the ones nobody remembered leaving on. That is the real value here. Close what should not be reachable, firewall what should be internal, and re-scan to confirm.

» Unexpected open ports are the finding; a forgotten admin panel or database port is exactly how intrusions start.

» A sudden full-range SYN sweep at high rate is an obvious signature in firewall and IDS logs; knowing it helps you recognise it against your own network.

» Re-run after any firewall change to confirm the surface shrank the way you intended.

Point masscan only at ranges you own or are authorized to assess. Its speed makes an out-of-scope scan both easy to launch and easy to trace back to you.

↑ contents