Network
Enumerate open ports on a host list before probing
A fast and reliable port scanner that enumerates open ports for hosts.
overview
What naabu does
naabu enumerates open ports for a host or a list of hosts. By default it runs fast stateless SYN scans, sends probes across the port set you choose, and lists every port that answers, turning a set of hosts into a map of exposed services. Written in Go for throughput, it sweeps wide ranges without the long waits of a heavier scanner.
It exposes the controls a real engagement needs. Pick SYN or CONNECT with -scan-type, set the probe -rate and worker count, target the -top-ports or a custom -port range, and drop noise with -exclude-ports. Host-discovery probes can front the scan so only live hosts get swept, and CDN awareness keeps naabu off cloud edges: flag the CDN in use with -display-cdn, or use -exclude-cdn to skip full scans of CDN ranges and check only 80 and 443.
Run naabu after subdomain or host discovery and its open host:port pairs feed the rest of a Trickest workflow. Emit JSON lines with -json or CSV and the results drop straight into httpx for probing and a scanner for testing, so later stages only touch ports that are actually open.
use cases
Where naabu fits
Map open ports across an estate
Scan a host list with SYN probes to enumerate every responding port, building the service map that probing and scanning stages depend on.
Scan wide scopes within rate limits
Tune the rate and worker count to cover large ranges quickly while staying inside a target's tolerance and your own bandwidth.
Skip CDN noise
Use exclude-cdn so cloud edge ranges only get checked on ports 80 and 443, keeping scan time focused on origin infrastructure.
Feed structured output to the pipeline
Emit JSON lines so the open host:port pairs flow straight into httpx for probing and a scanner for testing without manual reshaping.
reference
naabu inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| host | STRING | -host | Hosts to scan ports for (comma-separated). |
| hosts-list | FILE | -l | List of hosts to scan ports, the usual pipeline input. |
| ports-to-enumerate | STRING | -port | Ports to enumerate (top-100, top-1000, full, or custom). |
| top-ports | STRING | -top-ports | Top ports to scan (default top 100). |
| rate | STRING | -rate | Rate of port scan probe requests (default 1000). |
| scan-type | STRING | -scan-type | Type of port scan, SYN or CONNECT (default s). |
| exclude-cdn | BOOLEAN | -exclude-cdn | Skip full port scans for CDNs, only checks 80 and 443. |
| json-output | BOOLEAN | -json | Write output in JSON lines format. |
Showing key inputs. naabu exposes 44 inputs in total.
Full flag reference (44 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| cdn | BOOLEAN | -display-cdn | display cdn in use |
| host | STRING | -host | hosts to scan ports for (comma-separated) |
| rate | STRING | -rate | Rate of port scan probe request (default 1000) |
| proxy | STRING | -proxy | socks5 proxy (ip[:port] / fqdn[:port]) |
| stats | BOOLEAN | -stats | Display stats of the running scan |
| nd-ping | BOOLEAN | -nd-ping | IPv6 Neighbor Discovery (host discovery needs to be enabled) |
| passive | BOOLEAN | -passive | display passive open ports using shodan internetdb api |
| threads | STRING | -c | General internal worker threads (default 25) |
| timeout | STRING | -timeout | Millisecond to wait before timing out (default 700) |
| verbose | BOOLEAN | -v | Show verbose output |
| arp-ping | BOOLEAN | -arp-ping | ARP ping (host discovery needs to be enabled) |
| no-colors | BOOLEAN | -no-color | Don't Use colors in output |
| resolvers | FILE | -r | list of custom resolvers for dns resolution |
| scan-type | STRING | -scan-type | type of port scan (SYN/CONNECT) (default "s") |
| source-ip | STRING | -source-ip | source ip and port (x.x.x.x:yyy) |
| top-ports | STRING | -top-ports | Top Ports to scan (default top 100) |
| csv-output | BOOLEAN | -csv | Write output in CSV format |
| debug-mode | BOOLEAN | -debug | display debugging information |
| hosts-list | FILE | -l | List of hosts to scan ports |
| ip-version | STRING | -ip-version | ip version to scan of hostname (4,6) - (default 4) |
| ping-probe | BOOLEAN | -ping | Perform ping probe to detect alive hosts |
| ports-file | FILE | -ports-file | File containing ports to scan for |
| proxy-auth | STRING | -proxy-auth | socks5 proxy authentication (username:password) |
| exclude-cdn | BOOLEAN | -exclude-cdn | Skip full port scans for CDNs (only checks for 80,443) |
| json-output | BOOLEAN | -json | Write output in JSON lines format |
| exclude-file | FILE | -exclude-file | List of hosts to exclude from scan |
| scan-all-ips | BOOLEAN | -scan-all-ips | Scan all the ips |
| warm-up-time | STRING | -warm-up-time | Time in seconds between scan phases (default 2) |
| exclude-hosts | STRING | -exclude-hosts | hosts to exclude from the scan (comma-separated) |
| exclude-ports | STRING | -exclude-ports | Ports to exclude from scan |
| probe-tcp-ack | BOOLEAN | -probe-tcp-ack | TCP ACK Ping (host discovery needs to be enabled) |
| probe-tcp-syn | BOOLEAN | -probe-tcp-syn | TCP SYN Ping (host discovery needs to be enabled) |
| host-discovery | BOOLEAN | -host-discovery | Run Host Discovery scan |
| port-threshold | STRING | -port-threshold | port threshold to skip port scan for the host |
| stats-interval | STRING | -si | number of seconds to wait between showing a statistics update (default 5) |
| validate-ports | BOOLEAN | -verify | Validate the ports again |
| probe-icmp-echo | BOOLEAN | -probe-icmp-echo | ICMP echo request Ping (host discovery needs to be enabled) |
| ports-to-exclude | STRING | -exclude-ports | Ports to exclude from enumeration |
| ports-to-enumerate | STRING | -port | Ports to enumerate for on hosts (top-100, top-1000, full, custom) |
| skip-host-discovery | BOOLEAN | -skip-host-discovery | Skip Host discovery |
| probe-icmp-timestamp | BOOLEAN | -probe-icmp-timestamp | ICMP timestamp request Ping (host discovery needs to be enabled) |
| probe-icmp-address-mask | BOOLEAN | -probe-icmp-address-mask | ICMP address mask request Ping (host discovery needs to be enabled) |
| only-host-port-in-output | BOOLEAN | -silent | Show only host:ports in output |
| number-of-retries-for-port-scan | STRING | -retries | Number of retries for the port scan probe (default 1) |
example
Run naabu
# scan a host list for the top 1000 ports, JSON lines outnaabu -l hosts.txt -top-ports 1000 -rate 1000 -exclude-cdn -json -o open-ports.jsonlexample.com:80example.com:443api.example.com:443api.example.com:8443staging.example.com:22staging.example.com:8080198.51.100.24:3306198.51.100.24:6379198.51.100.51:5432guidance
Choosing naabu
Use naabu to find which ports are open before you probe or scan. It is a port scanner, not a service prober, so feed its open host:port pairs to httpx for classification and a vulnerability scanner for testing. Reach for it when you need fast, scriptable port enumeration in a pipeline.
masscan
Internet-scale SYN scanner with raw speed. naabu is friendlier to wire into a pipeline and handles CDNs out of the box.
rustscan
Fast scanner that hands ports to nmap for service detection. naabu favors clean structured output over nmap integration.
nmap
Deeper service and version detection, slower. Run nmap after naabu narrows the port set.
faq
naabu questions
related
More Network tools
asnmap
Map an organization's network ranges from ASN data.
dnsvalidator
Validate public DNS resolvers against trusted baselines.
fping
Parallel ICMP echo sweeps for CIDR ranges and host files.
httprobe
Probe a domain list for working HTTP and HTTPS servers.
httpx
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
mapcidr
Expand, aggregate, and slice CIDR ranges into host lists.
Run naabu yourself
A host list feeds naabu, which enumerates open ports and hands them to httpx for probing before the live services land as a queryable output.
Facts on this page come from the live Trickest tool library.