Network
Find open ports across wide IP ranges
Raw-socket SYN scanner for internet-wide port discovery, with optional banners and scripts.
overview
What nscan does
nscan fills the port-discovery slot before httpx or a service scanner: give it an IP or CIDR and a --port set, and it returns open ports as a file and folder.
Reach for it when you need masscan-style SYN coverage with --banner and --import in the same pass, or UDP via -s U. Pace wide sweeps with --cooldown so the host and upstream stay within limits.
Unlike masscan, nscan bundles inline banners and importable scripts. Unlike a vulnerability scanner, it only reports port state and first service signals; wire outputs to a prober or nuclei next.
use cases
Where nscan fits
Sweep wide ranges for open ports
Point nscan at a target IP or CIDR range with a broad port set and let its raw-socket SYN engine cover the range fast, the way an internet-wide scan needs.
Grab banners during the scan
Enable --banner so each open port returns a first service hint in the same pass, without a separate probing run.
Run scripts against matched ports
Use --import to check specific services, such as an SSH key check on port 22 or a proxy check across a web port range, as ports are found.
Pace a scan to stay in bounds
Tune --cooldown to sleep between batches of packets so a wide scan does not overrun the host or the upstream network.
reference
nscan inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| ip | STRING | · | Target IP address or CIDR range to scan. |
| port | STRING | --port | Ports to scan (single, list, or range). |
| style | STRING | -s | Scan type, S for SYN or U for UDP (default S). |
| cooldown | STRING | --cooldown | After every N packets sent, sleep P seconds (default 1000,1). |
| fetch-banners | BOOLEAN | --banner | Fetch service banners for open ports. |
| import-script | STRING | --import | nscan scripts to import (e.g. ssh_key:22+check_proxy:80-85,8080). |
| results-count | STRING | -n | Number of results to return. |
Showing key inputs. nscan exposes 7 inputs in total.
example
Run nscan
# SYN scan a /24 for common ports and grab bannersnscan 198.51.100.0/24 --port 22,80,443,8080 -s S --banner --cooldown 1000,1198.51.100.12 22 open198.51.100.12 80 open198.51.100.45 443 open198.51.100.77 8080 open203.0.113.9 22 open SSH-2.0-OpenSSH_9.6203.0.113.9 80 open Server: nginx/1.24.0203.0.113.21 443 openguidance
Choosing nscan
Use nscan for fast port discovery across wide IP ranges with its own packet stack. It finds open ports and can grab banners, but it is not a vulnerability scanner. For mature Go-based scanning, masscan and naabu are close peers.
masscan
Internet-wide SYN scanner nscan is modeled on. Larger ecosystem; nscan adds inline banner and script support.
naabu
Go port scanner that pairs cleanly with httpx and nuclei. nscan leans toward raw-socket SYN coverage.
zmap
Single-port internet-wide research scanner. nscan handles multi-port scans with banners in one tool.
faq
nscan questions
related
More Network tools
asnmap
Map an organization's network ranges from ASN data.
dnsvalidator
Validate public DNS resolvers against trusted baselines.
fping
Parallel ICMP echo sweeps for CIDR ranges and host files.
httprobe
Probe a domain list for working HTTP and HTTPS servers.
httpx
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
mapcidr
Expand, aggregate, and slice CIDR ranges into host lists.
Run nscan yourself
A target IP feeds nscan, which finds open ports and passes them to httpx for probing before the live ports land as a queryable output.
Facts on this page come from the live Trickest tool library.