Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Network

Map open ports before deeper service scanners run

Port discovery that lists open ports for downstream service detection.

Agent
Map open ports across a host rangeScan a focused port setTune speed against host limits

overview

What rustscan does

rustscan takes CIDRs, IPs, or hostnames via --addresses (or a file) and reports which ports answer. Scope the sweep with --top (top 1000), an explicit --ports list, or a --range. Enable --udp when you need datagram listeners too.

Throughput is governed by --batch-size, --timeout, and --ulimit. Raise the batch only as far as the OS open-file limit and the target allow. Exclude ports or addresses when scope says so. The tool finds open ports; it does not replace service fingerprinting.

In a Trickest Network workflow, run it early to build the live port list, then route host:port pairs into nmap, fingerprintx, or vuln checks. Prefer rustscan for discovery; keep nmap for version and NSE work on the short open-port set.

source github.com/RustScan/RustScan

use cases

Where rustscan fits

Map open ports across a host range

Feed CIDRs, IPs, or hostnames and let rustscan sweep them quickly, producing the open-port list that downstream service detection consumes.

Scan a focused port set

Use --top, an explicit --ports list, or a --range to bound the scan to the ports a given assessment cares about.

Tune speed against host limits

Raise or lower --batch-size and --ulimit to push throughput while staying inside your OS open-file limit and the target's tolerance.

Cover UDP services

Enable --udp to find ports that answer over UDP, which a default TCP-only sweep would miss.

reference

rustscan inputs and flags

18 inputs
NameTypeFlagDescription
addressesSTRING--addressesComma-delimited list of CIDRs, IPs, or hosts to scan.
addresses-fileFILE--addressesNewline-delimited file of CIDRs, IPs, or hosts to scan.
portsSTRING--portsComma-separated ports to scan. Example: 80,443,8080.
rangeSTRING--rangePort range in start-end format. Example: 1-1000.
topBOOLEAN--topUse the top 1000 ports.
udpBOOLEAN--udpUDP scanning mode for ports that respond over UDP.
batch-sizeSTRING--batch-sizeBatch size for port scanning; controls speed. Default: 4500.
timeoutSTRING--timeoutTimeout in milliseconds before a port is assumed closed. Default: 1500.

Showing key inputs. rustscan exposes 18 inputs in total.

Full flag reference (18 inputs)
NameTypeFlagDescription
topBOOLEAN--topUse the top 1000 ports
udpBOOLEAN--udpUDP scanning mode, finds UDP ports that send back responses
portsSTRING--portsA list of comma separated ports to be scanned. Example: 80,443,8080
rangeSTRING--rangeA range of ports with format start-end. Example: 1-1000
triesSTRING--triesThe number of tries before a port is assumed to be closed. If set to 0, rustscan will correct it to 1 [default: 1]
ulimitSTRING--ulimitAutomatically ups the ULIMIT with the value you provided
timeoutSTRING--timeoutThe timeout in milliseconds before a port is assumed to be closed [default: 1500]
resolverSTRING--resolverA comma-delimited list of DNS resolvers
addressesSTRING--addressesA comma-delimited list of separated CIDRs, IPs, or hosts to be scanned
no-configBOOLEAN--no-configWhether to ignore the configuration file or not
accessibleBOOLEAN--accessibleAccessible mode. Turns off features which negatively affect screen readers
batch-sizeSTRING--batch-sizeThe batch size for port scanning, it increases or slows the speed of scanning. Depends on the open file limit of your OS. If you do 65535 it will do every port at the same time. Although, your OS may not support this [default: 4500]
scan-orderSTRING--scan-orderThe order of scanning to be performed. The "serial" option will scan ports in ascending order while the "random" option will scan ports randomly [default: serial] [possible values: serial, random]
config-pathFILE--config-pathCustom path to config file
exclude-portsSTRING--exclude-portsA list of comma separated ports to be excluded from scanning. Example: 80,443,8080
resolver-fileFILE--resolverA file of DNS resolvers
addresses-fileFILE--addressesA newline-delimited file of separated CIDRs, IPs, or hosts to be scanned
exclude-addressesSTRING--exclude-addresseslist of comma separated CIDRs, IPs, or hosts to be excluded from scanning

example

Run rustscan

rustscan · command
# fast top-1000 sweep of a lab host, then raise ulimit for wider batchesrustscan --addresses 198.51.100.10 --top --ulimit 5000 --batch-size 4500 --timeout 1500
sample output
Open 198.51.100.10:22Open 198.51.100.10:80Open 198.51.100.10:443Open 198.51.100.10:8080Open 203.0.113.88:22Open 203.0.113.88:443Open example.com:80Open example.com:443

guidance

Choosing rustscan

Use rustscan when you need an open-port list from a host range before deeper analysis. nmap owns service and script detection. masscan and naabu are peer discovery scanners. Pair rustscan with nmap; do not treat it as a full replacement.

nmap

Deep follow-up: service detection, version probing, and NSE scripts on the open ports rustscan finds.

naabu

Fast Go port scanner from ProjectDiscovery with a similar discovery role.

scanless

Outsources port scans to third-party sites when you want no direct probe traffic.

workflows

Workflows using rustscan

3 workflows

  1. ASN-Wide Vulnerability Scan

    Turn an ASN into its live hosts, then scan the raw ports and the web surface for CVEs, misconfigurations, and exposures. Findings land in one report.

  2. Find Exposed Databases

    Port-scan a range for eight database engines and check every open service for unauthenticated access, from MongoDB and Redis to PostgreSQL.

  3. Full Network Port & Service Assessment

    Point one domain, ASN or CIDR at it and get a graded report of every open port and exposed service, distributed and token-free.

faq

rustscan questions

No. It finds open ports and can hand them to a scripting engine. For version probing and NSE scripts, follow with nmap on the open set.

related

More Network tools

  1. asnmap

    Map an organization's network ranges from ASN data.

  2. dnsvalidator

    Validate public DNS resolvers against trusted baselines.

  3. fping

    Parallel ICMP echo sweeps for CIDR ranges and host files.

  4. httprobe

    Probe a domain list for working HTTP and HTTPS servers.

  5. httpx

    A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.

  6. mapcidr

    Expand, aggregate, and slice CIDR ranges into host lists.

Run rustscan yourself

A host list feeds RustScan, which finds open ports fast and hands them to nmap for service detection before they land as a queryable output.

Open rustscan in the libraryView the workflow

Facts on this page come from the live Trickest tool library.