loading
Loading content
loading
Network
Raw-socket SYN scanner for internet-wide port discovery, with optional banners and scripts.
overview
nscan fills the port-discovery slot before httpx or a service scanner: give it an IP or CIDR and a --port set, and it returns open ports as a file and folder.
Reach for it when you need masscan-style SYN coverage with --banner and --import in the same pass, or UDP via -s U. Pace wide sweeps with --cooldown so the host and upstream stay within limits.
Unlike masscan, nscan bundles inline banners and importable scripts. Unlike a vulnerability scanner, it only reports port state and first service signals; wire outputs to a prober or nuclei next.
use cases
Point nscan at a target IP or CIDR range with a broad port set and let its raw-socket SYN engine cover the range fast, the way an internet-wide scan needs.
Enable --banner so each open port returns a first service hint in the same pass, without a separate probing run.
Use --import to check specific services, such as an SSH key check on port 22 or a proxy check across a web port range, as ports are found.
Tune --cooldown to sleep between batches of packets so a wide scan does not overrun the host or the upstream network.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| ip | STRING | · | Target IP address or CIDR range to scan. |
| port | STRING | --port | Ports to scan (single, list, or range). |
| style | STRING | -s | Scan type, S for SYN or U for UDP (default S). |
| cooldown | STRING | --cooldown | After every N packets sent, sleep P seconds (default 1000,1). |
| fetch-banners | BOOLEAN | --banner | Fetch service banners for open ports. |
| import-script | STRING | --import | nscan scripts to import (e.g. ssh_key:22+check_proxy:80-85,8080). |
| results-count | STRING | -n | Number of results to return. |
Showing key inputs. nscan exposes 7 inputs in total.
example
# SYN scan a /24 for common ports and grab bannersnscan 198.51.100.0/24 --port 22,80,443,8080 -s S --banner --cooldown 1000,1198.51.100.12 22 open198.51.100.12 80 open198.51.100.45 443 open198.51.100.77 8080 open203.0.113.9 22 open SSH-2.0-OpenSSH_9.6203.0.113.9 80 open Server: nginx/1.24.0203.0.113.21 443 openguidance
Use nscan for fast port discovery across wide IP ranges with its own packet stack. It finds open ports and can grab banners, but it is not a vulnerability scanner. For mature Go-based scanning, masscan and naabu are close peers.
Internet-wide SYN scanner nscan is modeled on. Larger ecosystem; nscan adds inline banner and script support.
Go port scanner that pairs cleanly with httpx and nuclei. nscan leans toward raw-socket SYN coverage.
Single-port internet-wide research scanner. nscan handles multi-port scans with banners in one tool.
faq
related
Map an organization's network ranges from ASN data.
Validate public DNS resolvers against trusted baselines.
Parallel ICMP echo sweeps for CIDR ranges and host files.
Probe a domain list for working HTTP and HTTPS servers.
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
Expand, aggregate, and slice CIDR ranges into host lists.
A target IP feeds nscan, which finds open ports and passes them to httpx for probing before the live ports land as a queryable output.
Facts on this page come from the live Trickest tool library.