loading
Loading content
loading
Network
RustScan over a target file, with optional scripting on each open-port hit.
overview
rustscan-loop runs RustScan across a file of CIDRs, IPs, or hosts. Each entry is scanned in turn. Open ports can feed the built-in scripting engine (Python, Lua, or Shell) when --scripts is set above None.
Bound the port set with --ports, --range, or --top. Tune --batch-size, --tries, --timeout, and --ulimit for throughput versus flaky hosts. --scan-order picks serial or random port order. This node exposes TCP discovery flags; UDP is not among its inputs.
Feed the addresses file from discovery; results write to FILE plus FOLDER before nmap service detection. Reach for it when targets already sit in a file and you want one batch TCP sweep. For a single host or inline target list, use plain rustscan instead.
source github.com/RustScan/RustScan
use cases
Pass the file of CIDRs, IPs, or hosts that earlier discovery produced and let RustScan Loop sweep every one for open ports in a single node.
Wire the open ports RustScan Loop finds into nmap for service and version detection, so the fast sweep and the deep scan run as one workflow.
Use the top-1000 flag, an explicit --ports list, or a --range like 1-1000 so each target is scanned only across the ports you care about.
Adjust --batch-size, --tries, and --timeout to push throughput on a large target file or to cut false closed-port reports on slow hosts.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| addresses | FILE | · | A file of CIDRs, IPs, or hosts to be scanned. |
| ports | STRING | --ports | Comma-separated ports to scan, e.g. 80,443,8080. |
| range | STRING | --range | A range of ports in start-end format, e.g. 1-1000. |
| top-ports | BOOLEAN | --top | Scan the top 1000 ports instead of a custom set. |
| scripts | STRING | --scripts | How much scripting runs after discovery: None, Default, or Custom. |
| batch-size | STRING | --batch-size | Batch size for scanning; higher is faster, bound by your OS open-file limit. Default: 4500. |
| timeout | STRING | --timeout | Timeout in milliseconds before a port is assumed closed. Default: 1500. |
| ulimit | STRING | --ulimit | Automatically raises the ULIMIT to the value you provide. |
Showing key inputs. rustscan-loop exposes 11 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| ports | STRING | --ports | Comma-separated ports to scan, e.g. 80,443,8080. |
| range | STRING | --range | A range of ports in start-end format, e.g. 1-1000. |
| tries | STRING | --tries | Tries before a port is assumed closed. A value of 0 is corrected to 1. Default: 1. |
| ulimit | STRING | --ulimit | Automatically raises the ULIMIT to the value you provide. |
| scripts | STRING | --scripts | Level of scripting to run after discovery: None, Default, or Custom. Default: default. |
| timeout | STRING | --timeout | Timeout in milliseconds before a port is assumed closed. Default: 1500. |
| addresses | FILE | · | A file of CIDRs, IPs, or hosts to be scanned. |
| no-config | BOOLEAN | --no-config | Ignore the RustScan configuration file. |
| top-ports | BOOLEAN | --top | Scan the top 1000 ports instead of a custom set. |
| batch-size | STRING | --batch-size | Batch size for scanning; higher is faster, bound by your OS open-file limit. Setting 65535 scans every port at once. Default: 4500. |
| scan-order | STRING | --scan-order | Order ports are scanned: Serial (ascending) or Random. Default: serial. |
example
# port-scan every CIDR, IP, or host in the file across ports 1-1000rustscan -a targets.txt --range 1-1000 --scripts none --batch-size 4500Open 198.51.100.10:22Open 198.51.100.10:80Open 198.51.100.10:443Open 198.51.100.23:8080Open 198.51.100.42:443Open 198.51.100.42:8443[~] Starting Script(s)[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")guidance
Use rustscan-loop when targets already sit in a file and you want one node to port-scan the whole set. For an inline list or single host, plain rustscan fits. For service and version detection, route open ports into nmap.
Base scanner for inline target lists and a wider flag set, including UDP scans.
Deep follow-up: service detection, version probing, and NSE scripts on open ports.
Fast Go port scanner that fits the same discovery-to-scan pipeline slot.
faq
related
Map an organization's network ranges from ASN data.
Validate public DNS resolvers against trusted baselines.
Parallel ICMP echo sweeps for CIDR ranges and host files.
Probe a domain list for working HTTP and HTTPS servers.
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
Expand, aggregate, and slice CIDR ranges into host lists.
A file of targets feeds RustScan Loop, which port-scans every entry and writes the open ports as a queryable output.
Facts on this page come from the live Trickest tool library.