Network
Sweep a wide IP range for open ports before slower tools run
Asynchronous SYN port scanner for wide IP ranges; bound runs with --rate and --excludefile.
overview
What masscan does
masscan sends probes and reads replies on separate threads, so it does not wait on one host before moving to the next. Give it a port set (-p) and an address block (--range or -iL) and it sweeps the whole range. It reports which ports answered.
Speed is the design trade. With --banners it pulls a short banner from the service behind an open port, but it skips nmap-style version fingerprinting. Bound the run with --rate (default 100 pps; raise it on a link you own), exclude addresses with --excludefile, and pin --source-ip when the scanner has several. Option syntax borrows from nmap, so -iL and -p feel familiar.
In a Trickest workflow the node reads a target list or IP range and writes a file plus a folder of open host:port pairs. Run it first across a wide scope, then hand those pairs to httpx and nuclei so slower stages only touch ports that already answered.
use cases
Where masscan fits
Sweep a wide IP range fast
Point masscan at an address range or a list of targets and enumerate open ports across the whole scope in one pass, building the service map the rest of the workflow depends on.
Control the rate for safe, wide scans
Set packets per second to match your bandwidth and the target's tolerance, so a large sweep finishes quickly without saturating the link or tripping defenses.
Grab banners during discovery
Turn on banner grabbing to pull a short identifying banner from each open port, adding cheap service context without a second tool pass.
Respect out-of-scope addresses
Feed an exclude file so masscan skips ranges you are not authorized to scan, keeping a fast Internet-scale sweep inside the rules of engagement.
reference
masscan inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| targets | FILE | -iL | File of targets (IPs or CIDR ranges) to scan, the usual pipeline input. |
| ip-range | STRING | --range | Range of IP addresses or CIDR blocks to scan. |
| ports | STRING | -p | Port or port range to scan, e.g. -p80,443 or -p0-65535. |
| rate | STRING | --rate | Transmit rate in packets per second (default 100). |
| banners | BOOLEAN | --banners | Grab a short service banner from each open port. |
| exclude-file | FILE | --excludefile | File of IP addresses or ranges to exclude from the scan. |
| single-source-ip-address | STRING | --source-ip | Send probes from a specific source IP address. |
| keep-packets-locally | STRING | --router-mac | Set the gateway MAC address for outgoing packets, which can keep a scan on the local segment. |
Showing key inputs. masscan exposes 9 inputs in total.
Full flag reference (9 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| rate | STRING | --rate | Transmit rate in packets per second (default 100). |
| ports | STRING | -p | Port or port range to scan, e.g. -p80,443 or -p0-65535; prefix U: for UDP ports. |
| banners | BOOLEAN | --banners | Grab a short service banner from each open port during the scan. |
| offline | BOOLEAN | --offline | Run without sending packets, to benchmark or test a configuration. |
| targets | FILE | -iL | Read the list of targets (IPs or CIDR ranges) to scan from a file. |
| ip-range | STRING | --range | Range of IP addresses or CIDR blocks to scan. |
| exclude-file | FILE | --excludefile | File of IP addresses or ranges to exclude from the scan. |
| keep-packets-locally | STRING | --router-mac | Destination (gateway) MAC address for outgoing packets; can keep a scan on the local segment. |
| single-source-ip-address | STRING | --source-ip | Send probes from a specific source IP address. |
example
Run masscan
# fast sweep of a CIDR for open web ports, out-of-scope IPs excluded, JSON outputmasscan 198.51.100.0/24 -p80,443,8000-8100 --rate 10000 --excludefile exclude.txt --banners -oJ scan.jsonStarting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2026-07-14 12:04:17 GMTInitiating SYN Stealth ScanScanning 256 hosts [4 ports/host]Discovered open port 443/tcp on 198.51.100.23Discovered open port 80/tcp on 198.51.100.23Discovered open port 22/tcp on 198.51.100.64Discovered open port 8080/tcp on 203.0.113.12Discovered open port 443/tcp on 203.0.113.88Banner on port 443/tcp on 198.51.100.23: [ssl] TLS/1.3 cipher:0x1301guidance
Choosing masscan
Reach for masscan when you need to scan a very wide IP range as fast as possible and only care which ports are open. It is a port scanner, not a service prober, so pass its open host:port pairs to httpx for classification and to nuclei for testing. For a more pipeline-friendly scanner with CDN handling and clean structured output, use naabu instead.
naabu
Pipeline-friendly Go port scanner with CDN handling and JSON output. Easier to wire downstream; masscan wins on raw range-sweeping speed.
nmap
Deep service and version detection, far slower. Run nmap after masscan narrows the open-port set.
fingerprintx
Identifies the service behind an open port. Complements masscan, which only reports that the port answers.
faq
masscan questions
related
More Network tools
asnmap
Map an organization's network ranges from ASN data.
dnsvalidator
Validate public DNS resolvers against trusted baselines.
fping
Parallel ICMP echo sweeps for CIDR ranges and host files.
httprobe
Probe a domain list for working HTTP and HTTPS servers.
httpx
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
mapcidr
Expand, aggregate, and slice CIDR ranges into host lists.
Run masscan yourself
A target list feeds masscan, which sweeps the range for open ports and hands them to httpx for probing before the live services land as a queryable output.
Facts on this page come from the live Trickest tool library.