loading
Loading content
loading
Network
Simple IP or CIDR sweep for open ports.
overview
netscan dials an IP or CIDR and reports every host:port that answers. Give it a single address or a block, choose ports and protocol, and it logs reachable pairs. You get a small-scope inventory without bringing in a heavy scanner.
Controls stay few. --ports takes a range or comma list (80-443 or 22,80,443). --proto selects tcp or udp and may be set more than once. --timeout bounds each dial so dead hosts fail quickly. --debug shows every probe, not only hits.
Feed live pairs into httpx or a service scanner next. Prefer netscan for a quick subnet pass; use naabu or masscan when you need rate control, CDN handling, or internet-scale SYN sweeps.
source github.com/jessfraz/netscan
use cases
Point netscan at a CIDR block to list which addresses are in use and which ports answer, building a quick map of an internal range before deeper work.
Pass --ports a range or comma-separated list so the sweep targets the services you care about instead of the default 80,443,8001,9001 web ports.
Set --proto to match the services in scope, and set it more than once to check both, switching to udp when DNS, SNMP, or similar services need testing.
Hand the discovered host:port pairs to httpx or a service scanner so classification only touches ports netscan already confirmed alive and reachable.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| ip-address | STRING | · | CIDR such as 192.168.0.1/24 or a single IP such as 192.168.104.30, given as the final positional argument. |
| ports | STRING | --ports | Ports to scan as a range or list (e.g. 80-443, 80,443,8080, or 1-20,22,80-443). Default 80,443,8001,9001. |
| protocol | STRING | --proto | Protocol to probe with, settable more than once. Default tcp. |
| timeout | STRING | --timeout | Timeout for the dial of each port (e.g. 1s, 500ms). Default 1s. |
| debug | BOOLEAN | --debug | Enable debug logging so every probe is shown, not only the ports that respond. Default false. |
Showing key inputs. netscan exposes 5 inputs in total.
example
# sweep a /24 for SSH and web ports over TCPnetscan --ports 22,80,443,8080 --proto tcp --timeout 2s 198.51.100.0/24time="2026-07-14T10:22:01Z" level=info msg="Scanning on 198.51.100.0/24 using protocols (tcp) over ports 22,80,443,8080"time="2026-07-14T10:22:03Z" level=info msg="tcp://198.51.100.10:22 is alive and reachable"time="2026-07-14T10:22:03Z" level=info msg="tcp://198.51.100.10:80 is alive and reachable"time="2026-07-14T10:22:04Z" level=info msg="tcp://198.51.100.23:443 is alive and reachable"time="2026-07-14T10:22:05Z" level=info msg="tcp://198.51.100.51:80 is alive and reachable"time="2026-07-14T10:22:05Z" level=info msg="tcp://198.51.100.51:8080 is alive and reachable"time="2026-07-14T10:22:07Z" level=info msg="tcp://198.51.100.104:443 is alive and reachable"guidance
Use netscan for a quick IP or CIDR sweep to find live hosts and open ports. It is a simple range scanner. Prefer it on internal subnets or small scopes, then hand results to a prober or service scanner.
Go port scanner with rate control, CDN handling, and JSON output. Prefer it for large or pipeline-heavy scans.
Internet-scale SYN scanner. netscan is simpler and better suited to a single subnet sweep.
Fast scanner that pipes ports into nmap. netscan trades that depth for a smaller, self-contained tool.
faq
related
Map an organization's network ranges from ASN data.
Validate public DNS resolvers against trusted baselines.
Parallel ICMP echo sweeps for CIDR ranges and host files.
Probe a domain list for working HTTP and HTTPS servers.
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
Expand, aggregate, and slice CIDR ranges into host lists.
A CIDR range feeds netscan, which finds live hosts and open ports and hands them to httpx for probing before the results land as a queryable output.
Facts on this page come from the live Trickest tool library.