How do I set which ports to scan?

Pass --ports with a comma-separated list (80,443,8080), a range (1-1024), or a preset such as medium, large, huge, or massive.

How is this different from masscan?

portboozle is a lighter stage aimed at hosts you already resolved with massdns. masscan is built for raw, internet-scale sweeps across huge address spaces.

What should run before portboozle?

A DNS stage such as massdns. portboozle scans resolved hosts and does not resolve names itself.

What should run after it?

A banner grabber or HTTP prober on the open ports, for example httpx or nmap service detection, so open listeners become identified services.

What does --timeout control?

The socket wait in seconds while probing each port (default 0.7). Increase it on high-latency paths; keep it low for fast local scans.

Updated Jul 15, 2026

Utilities

Probe open TCP ports on massdns-resolved hosts

Lightweight TCP port scanner for massdns-resolved hosts.

Port-scan massdns results Sweep a wide port range Tune for slow networks

overview

What portboozle does

Place portboozle after massdns and before banner grabbing or HTTP probing. It reads a massdns-output file, probes the ports you set, and writes FILE and FOLDER results of open listeners.

Set --ports to a comma list (80,443), a range (1-1024), or a size preset (medium, large, huge, massive). --timeout controls socket wait in seconds (default 0.7) so high latency does not stall the run.

Prefer masscan or zmap for raw internet-scale address sweeps. Prefer naabu when you want a Go pipeline scanner without a massdns-first input shape. portboozle does not resolve names.

source github.com/fellchase/flumberboozle

use cases

Where portboozle fits

Port-scan massdns results

Take a massdns resolution file and probe common or custom TCP ports so only hosts with open listeners continue in the workflow.

Sweep a wide port range

Set --ports to a large range or a size preset when you need broader coverage than a short top-ports list.

Tune for slow networks

Raise --timeout when high latency causes missed open ports, or lower it when you want a faster pass over a reliable link.

reference

portboozle inputs and flags

3 inputs

Name	Type	Flag	Description
massdns-output	FILE	·	Massdns output file of resolved hosts to scan.
ports	STRING	--ports	Target ports as a comma list, a range, or a size preset (medium, large, huge, massive).
timeout	STRING	--timeout	Socket timeout for port scanning (default 0.7).

Showing key inputs. portboozle exposes 3 inputs in total.

example

Run portboozle

portboozle · command

# scan hosts from massdns output for common web portsportboozle --ports 80,443,8080,8443 --timeout 1.0

sample output

198.51.100.10:80198.51.100.10:443198.51.100.23:443198.51.100.64:22203.0.113.15:80203.0.113.15:443203.0.113.40:8080

guidance

Choosing portboozle

Use portboozle for a thin TCP port stage over hosts already resolved with massdns. It does not resolve DNS. For internet-scale SYN sweeps, use masscan instead.

masscan

High-speed scanner for wide address spaces. Heavier than portboozle when you already have massdns hosts.

naabu

Fast Go port scanner with clean pipeline output. Common alternative when input is not massdns-shaped.

rustscan

Quick port sweep that hands open ports to nmap for deeper inspection.

faq

portboozle questions

A massdns output file. Resolve names with massdns first, then point the massdns-output input at that file so it scans IPs rather than raw hostnames.

Run portboozle yourself

A massdns output file feeds Portboozle, which scans the resolved hosts for open ports and writes the result as a queryable output.

Run portboozle in Trickest Browse the library

Facts on this page come from the live Trickest tool library.