Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Network

Sweep a subnet for live host:port pairs

netscan is a small Go tool that scans a network for open ports on an IP or CIDR range and reports which IPs are in use, taking a port list and protocol selection and logging every reachable host:port pair.

installgo install github.com/jessfraz/netscan@latest

Go · MIT license

Agent
Inventory a subnetScan a custom port setProbe over TCP or UDP

overview

What netscan does

netscan dials an IP or CIDR and reports every host:port that answers. Give it a single address or a block, choose ports and protocol, and it logs reachable pairs. You get a small-scope inventory without bringing in a heavy scanner.

Controls stay few. --ports takes a range or comma list (80-443 or 22,80,443). --proto selects tcp or udp and may be set more than once. --timeout bounds each dial so dead hosts fail quickly. --debug shows every probe, not only hits.

Feed live pairs into httpx or a service scanner next. Prefer netscan for a quick subnet pass; use naabu or masscan when you need rate control, CDN handling, or internet-scale SYN sweeps.

source github.com/jessfraz/netscan

use cases

Where netscan fits

Inventory a subnet

Point netscan at a CIDR block to list which addresses are in use and which ports answer, building a quick map of an internal range before deeper work.

Scan a custom port set

Pass --ports a range or comma-separated list so the sweep targets the services you care about instead of the default 80,443,8001,9001 web ports.

Probe over TCP or UDP

Set --proto to match the services in scope, and set it more than once to check both, switching to udp when DNS, SNMP, or similar services need testing.

Feed a probing pipeline

Hand the discovered host:port pairs to httpx or a service scanner so classification only touches ports netscan already confirmed alive and reachable.

reference

netscan inputs and flags

5 inputs
NameTypeFlagDescription
ip-addressSTRING·CIDR such as 192.168.0.1/24 or a single IP such as 192.168.104.30, given as the final positional argument.
portsSTRING--portsPorts to scan as a range or list (e.g. 80-443, 80,443,8080, or 1-20,22,80-443). Default 80,443,8001,9001.
protocolSTRING--protoProtocol to probe with, settable more than once. Default tcp.
timeoutSTRING--timeoutTimeout for the dial of each port (e.g. 1s, 500ms). Default 1s.
debugBOOLEAN--debugEnable debug logging so every probe is shown, not only the ports that respond. Default false.

Showing key inputs. netscan exposes 5 inputs in total.

example

Run netscan

netscan · command
# sweep a /24 for SSH and web ports over TCP
netscan --ports 22,80,443,8080 --proto tcp --timeout 2s 198.51.100.0/24
sample output
time="2026-07-14T10:22:01Z" level=info msg="Scanning on 198.51.100.0/24 using protocols (tcp) over ports 22,80,443,8080"
time="2026-07-14T10:22:03Z" level=info msg="tcp://198.51.100.10:22 is alive and reachable"
time="2026-07-14T10:22:03Z" level=info msg="tcp://198.51.100.10:80 is alive and reachable"
time="2026-07-14T10:22:04Z" level=info msg="tcp://198.51.100.23:443 is alive and reachable"
time="2026-07-14T10:22:05Z" level=info msg="tcp://198.51.100.51:80 is alive and reachable"
time="2026-07-14T10:22:05Z" level=info msg="tcp://198.51.100.51:8080 is alive and reachable"
time="2026-07-14T10:22:07Z" level=info msg="tcp://198.51.100.104:443 is alive and reachable"

guidance

Choosing netscan

Use netscan for a quick IP or CIDR sweep to find live hosts and open ports. It is a simple range scanner. Prefer it on internal subnets or small scopes, then hand results to a prober or service scanner.

naabu

Go port scanner with rate control, CDN handling, and JSON output. Prefer it for large or pipeline-heavy scans.

masscan

Internet-scale SYN scanner. netscan is simpler and better suited to a single subnet sweep.

rustscan

Fast scanner that pipes ports into nmap. netscan trades that depth for a smaller, self-contained tool.

faq

netscan questions

Pass the target as the final argument: a single IP scans one host; a CIDR such as 198.51.100.0/24 sweeps the block. On Trickest, set the ip-address input to the IP or CIDR.

Use --ports with a range, a comma list, or both: 80-443, 22,80,443,8080, or 1-20,22,80-443. Unset, netscan checks 80,443,8001,9001.

Yes. --proto defaults to tcp; pass udp for UDP, and set the flag more than once to probe both. UDP hits are less definitive than TCP because there is no handshake.

For every port that answers, it logs a line like tcp://198.51.100.10:80 is alive and reachable. Add --debug to also see each probe, which helps when a short --timeout hides slow hosts.

When the scope is large, you need rate limits or CDN-aware behavior, or you want structured JSON for a pipeline. netscan stays the lighter choice for a small subnet inventory.

related

More Network tools

  1. asnmap

    Map an organization's network ranges from ASN data.

  2. dnsvalidator

    Validate public DNS resolvers against trusted baselines.

  3. fping

    Parallel ICMP echo sweeps for CIDR ranges and host files.

  4. httprobe

    Probe a domain list for working HTTP and HTTPS servers.

  5. httpx

    A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.

  6. mapcidr

    Expand, aggregate, and slice CIDR ranges into host lists.

Run netscan yourself

A CIDR range feeds netscan, which finds live hosts and open ports and hands them to httpx for probing before the results land as a queryable output.

Run netscan in TrickestBrowse the library

Facts on this page come from the live Trickest tool library.