loading
Loading content
loading
Network
Port discovery that lists open ports for downstream service detection.
overview
rustscan takes CIDRs, IPs, or hostnames via --addresses (or a file) and reports which ports answer. Scope the sweep with --top (top 1000), an explicit --ports list, or a --range. Enable --udp when you need datagram listeners too.
Throughput is governed by --batch-size, --timeout, and --ulimit. Raise the batch only as far as the OS open-file limit and the target allow. Exclude ports or addresses when scope says so. The tool finds open ports; it does not replace service fingerprinting.
In a Trickest Network workflow, run it early to build the live port list, then route host:port pairs into nmap, fingerprintx, or vuln checks. Prefer rustscan for discovery; keep nmap for version and NSE work on the short open-port set.
source github.com/RustScan/RustScan
use cases
Feed CIDRs, IPs, or hostnames and let rustscan sweep them quickly, producing the open-port list that downstream service detection consumes.
Use --top, an explicit --ports list, or a --range to bound the scan to the ports a given assessment cares about.
Raise or lower --batch-size and --ulimit to push throughput while staying inside your OS open-file limit and the target's tolerance.
Enable --udp to find ports that answer over UDP, which a default TCP-only sweep would miss.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| addresses | STRING | --addresses | Comma-delimited list of CIDRs, IPs, or hosts to scan. |
| addresses-file | FILE | --addresses | Newline-delimited file of CIDRs, IPs, or hosts to scan. |
| ports | STRING | --ports | Comma-separated ports to scan. Example: 80,443,8080. |
| range | STRING | --range | Port range in start-end format. Example: 1-1000. |
| top | BOOLEAN | --top | Use the top 1000 ports. |
| udp | BOOLEAN | --udp | UDP scanning mode for ports that respond over UDP. |
| batch-size | STRING | --batch-size | Batch size for port scanning; controls speed. Default: 4500. |
| timeout | STRING | --timeout | Timeout in milliseconds before a port is assumed closed. Default: 1500. |
Showing key inputs. rustscan exposes 18 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| top | BOOLEAN | --top | Use the top 1000 ports |
| udp | BOOLEAN | --udp | UDP scanning mode, finds UDP ports that send back responses |
| ports | STRING | --ports | A list of comma separated ports to be scanned. Example: 80,443,8080 |
| range | STRING | --range | A range of ports with format start-end. Example: 1-1000 |
| tries | STRING | --tries | The number of tries before a port is assumed to be closed. If set to 0, rustscan will correct it to 1 [default: 1] |
| ulimit | STRING | --ulimit | Automatically ups the ULIMIT with the value you provided |
| timeout | STRING | --timeout | The timeout in milliseconds before a port is assumed to be closed [default: 1500] |
| resolver | STRING | --resolver | A comma-delimited list of DNS resolvers |
| addresses | STRING | --addresses | A comma-delimited list of separated CIDRs, IPs, or hosts to be scanned |
| no-config | BOOLEAN | --no-config | Whether to ignore the configuration file or not |
| accessible | BOOLEAN | --accessible | Accessible mode. Turns off features which negatively affect screen readers |
| batch-size | STRING | --batch-size | The batch size for port scanning, it increases or slows the speed of scanning. Depends on the open file limit of your OS. If you do 65535 it will do every port at the same time. Although, your OS may not support this [default: 4500] |
| scan-order | STRING | --scan-order | The order of scanning to be performed. The "serial" option will scan ports in ascending order while the "random" option will scan ports randomly [default: serial] [possible values: serial, random] |
| config-path | FILE | --config-path | Custom path to config file |
| exclude-ports | STRING | --exclude-ports | A list of comma separated ports to be excluded from scanning. Example: 80,443,8080 |
| resolver-file | FILE | --resolver | A file of DNS resolvers |
| addresses-file | FILE | --addresses | A newline-delimited file of separated CIDRs, IPs, or hosts to be scanned |
| exclude-addresses | STRING | --exclude-addresses | list of comma separated CIDRs, IPs, or hosts to be excluded from scanning |
example
# fast top-1000 sweep of a lab host, then raise ulimit for wider batchesrustscan --addresses 198.51.100.10 --top --ulimit 5000 --batch-size 4500 --timeout 1500Open 198.51.100.10:22Open 198.51.100.10:80Open 198.51.100.10:443Open 198.51.100.10:8080Open 203.0.113.88:22Open 203.0.113.88:443Open example.com:80Open example.com:443guidance
Use rustscan when you need an open-port list from a host range before deeper analysis. nmap owns service and script detection. masscan and naabu are peer discovery scanners. Pair rustscan with nmap; do not treat it as a full replacement.
Deep follow-up: service detection, version probing, and NSE scripts on the open ports rustscan finds.
Fast Go port scanner from ProjectDiscovery with a similar discovery role.
Outsources port scans to third-party sites when you want no direct probe traffic.
faq
related
Map an organization's network ranges from ASN data.
Validate public DNS resolvers against trusted baselines.
Parallel ICMP echo sweeps for CIDR ranges and host files.
Probe a domain list for working HTTP and HTTPS servers.
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
Expand, aggregate, and slice CIDR ranges into host lists.
A host list feeds RustScan, which finds open ports fast and hands them to nmap for service detection before they land as a queryable output.
Facts on this page come from the live Trickest tool library.