Scan huge IP ranges for open ports in minutes

masscan sends probes and reads replies on separate threads, so it never waits on a single host before moving to the next. Give it a port set and a block of addresses and it sweeps the whole range asynchronously, reaching up to 10 million packets per second from one machine and covering the entire IPv4 space in minutes. It reports which ports answered and nothing slower than that.

Speed is the whole design, and the trade is depth. masscan confirms a port is open and, with --banners on, pulls a short banner from the service behind it, but it skips nmap-style version fingerprinting. You bound a run with --rate to stay inside your bandwidth and a target's tolerance, set the port range with -p, exclude addresses you must not touch with --excludefile, and pin --source-ip when the scanning host carries several. Its option syntax borrows from nmap, so -iL and -p feel familiar.

In a Trickest workflow the node reads a target list or an IP range and writes a file and a folder of open host:port pairs. Run it first to find live ports across a wide scope, then hand those pairs to a prober such as httpx and a scanner such as nuclei, so the slower stages only touch ports that already answered.