Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Network

Sweep IP ranges for open ports as JSON

Asynchronous masscan port sweep with structured JSON output.

Agent
Sweep a large IP range fastFeed open ports to a service proberGrab banners during discovery

overview

What masscan-json does

masscan-json runs the asynchronous masscan scanner and writes structured JSON instead of a text grid. Set --rate for packets per second, -p for ports, and --range or -iL for targets.

Optional --banners grabs a short service hint. --excludefile keeps out-of-scope addresses out of the sweep. JSON lets a downstream node read host and port as fields.

Trickest runs it as a managed Network node that writes a FILE and FOLDER. Use it as the wide first pass, then hand open ports to a prober. Prefer plain masscan when text output is enough.

source github.com/robertdavidgraham/masscan

use cases

Where masscan-json fits

Sweep a large IP range fast

Scan a full CIDR block or acquired netblock for open ports in one pass, then narrow slower tooling to the hosts that answer.

Feed open ports to a service prober

Emit JSON so a downstream node reads host and port pairs as fields and probes each one for the service behind it.

Grab banners during discovery

Turn on --banners to capture a service hint alongside each open port so triage starts without a second connection per host.

Scope a scan safely

Set --excludefile and a controlled --rate to keep a wide sweep inside the ranges you own and within the network's tolerance.

reference

masscan-json inputs and flags

9 inputs
NameTypeFlagDescription
ip-rangeSTRING--rangeRange of IP addresses to be scanned.
targetsFILE-iLList of targets.
portsSTRING-pPort or Port range to be scanned.
rateSTRING--ratePackets per second. Default: 100.
bannersBOOLEAN--bannersGrab banner information.
exclude-fileFILE--excludefileExclude a range of ports.
single-source-ip-addressSTRING--source-ipProvide a separate source ip address.

Showing key inputs. masscan-json exposes 9 inputs in total.

Full flag reference (9 inputs)
NameTypeFlagDescription
rateSTRING--ratePackets per second. Default: 100
portsSTRING-pPort or Port range to be scanned
bannersBOOLEAN--bannersGrab banner information
offlineBOOLEAN--offlineTest in offline mode
targetsFILE-iLList of targets
ip-rangeSTRING--rangeRange of IP adresses to be scanned
exclude-fileFILE--excludefileExclude a range of ports
keep-packets-locallySTRING--router-macKeeps packets on the local network segments so that they won't go out to the Internet.
single-source-ip-addressSTRING--source-ipProvide a separate source ip address

example

Run masscan-json

masscan-json · command
# masscan-json: JSON sweep of a documentation netblock for common web portsmasscan 198.51.100.0/24 -p80,443,8080 --rate 1000 --banners -oJ open-ports.json
sample output
{"ip":"198.51.100.23","port":443,"proto":"tcp","status":"open"}{"ip":"198.51.100.23","port":80,"proto":"tcp","status":"open"}{"ip":"198.51.100.64","port":22,"proto":"tcp","status":"open"}{"ip":"203.0.113.12","port":8080,"proto":"tcp","status":"open"}{"ip":"203.0.113.88","port":443,"proto":"tcp","status":"open"}{"ip":"203.0.113.88","port":80,"proto":"tcp","status":"open"}{"ip":"198.51.100.17","port":8443,"proto":"tcp","status":"open"}

guidance

Choosing masscan-json

Use masscan-json for a wide first pass when you need open ports across a large IP range and want JSON fields for the next node. It is a port sweeper, not a service or vulnerability scanner. Pair it with a prober.

masscan

Same scanner with default text output. Use masscan-json when a downstream node needs parseable fields.

massdns

Resolves domains at scale instead of scanning ports. Build the target list, then sweep with masscan-json.

mapcidr

Expands and splits CIDR ranges before this scanner sweeps them.

faq

masscan-json questions

Same scanner, different output. masscan-json emits structured JSON so downstream nodes parse open host and port pairs as fields instead of grepping a text grid.

related

More Network tools

  1. asnmap

    Map an organization's network ranges from ASN data.

  2. dnsvalidator

    Validate public DNS resolvers against trusted baselines.

  3. fping

    Parallel ICMP echo sweeps for CIDR ranges and host files.

  4. httprobe

    Probe a domain list for working HTTP and HTTPS servers.

  5. httpx

    A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.

  6. mapcidr

    Expand, aggregate, and slice CIDR ranges into host lists.

Run masscan-json yourself

An IP range is expanded by mapcidr, masscan-json sweeps the resulting hosts for open ports, and the open host and port pairs are written as JSON output.

Open masscan-json in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.