Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Network

Port-scan every host in a target file

RustScan over a target file, with optional scripting on each open-port hit.

Agent
Port-scan a batch of discovered hostsFeed open ports into deeper scanningBound the port set per run

overview

What rustscan-loop does

rustscan-loop runs RustScan across a file of CIDRs, IPs, or hosts. Each entry is scanned in turn. Open ports can feed the built-in scripting engine (Python, Lua, or Shell) when --scripts is set above None.

Bound the port set with --ports, --range, or --top. Tune --batch-size, --tries, --timeout, and --ulimit for throughput versus flaky hosts. --scan-order picks serial or random port order. This node exposes TCP discovery flags; UDP is not among its inputs.

Feed the addresses file from discovery; results write to FILE plus FOLDER before nmap service detection. Reach for it when targets already sit in a file and you want one batch TCP sweep. For a single host or inline target list, use plain rustscan instead.

source github.com/RustScan/RustScan

use cases

Where rustscan-loop fits

Port-scan a batch of discovered hosts

Pass the file of CIDRs, IPs, or hosts that earlier discovery produced and let RustScan Loop sweep every one for open ports in a single node.

Feed open ports into deeper scanning

Wire the open ports RustScan Loop finds into nmap for service and version detection, so the fast sweep and the deep scan run as one workflow.

Bound the port set per run

Use the top-1000 flag, an explicit --ports list, or a --range like 1-1000 so each target is scanned only across the ports you care about.

Tune for speed or reliability

Adjust --batch-size, --tries, and --timeout to push throughput on a large target file or to cut false closed-port reports on slow hosts.

reference

rustscan-loop inputs and flags

11 inputs
NameTypeFlagDescription
addressesFILE·A file of CIDRs, IPs, or hosts to be scanned.
portsSTRING--portsComma-separated ports to scan, e.g. 80,443,8080.
rangeSTRING--rangeA range of ports in start-end format, e.g. 1-1000.
top-portsBOOLEAN--topScan the top 1000 ports instead of a custom set.
scriptsSTRING--scriptsHow much scripting runs after discovery: None, Default, or Custom.
batch-sizeSTRING--batch-sizeBatch size for scanning; higher is faster, bound by your OS open-file limit. Default: 4500.
timeoutSTRING--timeoutTimeout in milliseconds before a port is assumed closed. Default: 1500.
ulimitSTRING--ulimitAutomatically raises the ULIMIT to the value you provide.

Showing key inputs. rustscan-loop exposes 11 inputs in total.

Full flag reference (11 inputs)
NameTypeFlagDescription
portsSTRING--portsComma-separated ports to scan, e.g. 80,443,8080.
rangeSTRING--rangeA range of ports in start-end format, e.g. 1-1000.
triesSTRING--triesTries before a port is assumed closed. A value of 0 is corrected to 1. Default: 1.
ulimitSTRING--ulimitAutomatically raises the ULIMIT to the value you provide.
scriptsSTRING--scriptsLevel of scripting to run after discovery: None, Default, or Custom. Default: default.
timeoutSTRING--timeoutTimeout in milliseconds before a port is assumed closed. Default: 1500.
addressesFILE·A file of CIDRs, IPs, or hosts to be scanned.
no-configBOOLEAN--no-configIgnore the RustScan configuration file.
top-portsBOOLEAN--topScan the top 1000 ports instead of a custom set.
batch-sizeSTRING--batch-sizeBatch size for scanning; higher is faster, bound by your OS open-file limit. Setting 65535 scans every port at once. Default: 4500.
scan-orderSTRING--scan-orderOrder ports are scanned: Serial (ascending) or Random. Default: serial.

example

Run rustscan-loop

rustscan-loop · command
# port-scan every CIDR, IP, or host in the file across ports 1-1000rustscan -a targets.txt --range 1-1000 --scripts none --batch-size 4500
sample output
Open 198.51.100.10:22Open 198.51.100.10:80Open 198.51.100.10:443Open 198.51.100.23:8080Open 198.51.100.42:443Open 198.51.100.42:8443[~] Starting Script(s)[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

guidance

Choosing rustscan-loop

Use rustscan-loop when targets already sit in a file and you want one node to port-scan the whole set. For an inline list or single host, plain rustscan fits. For service and version detection, route open ports into nmap.

rustscan

Base scanner for inline target lists and a wider flag set, including UDP scans.

nmap

Deep follow-up: service detection, version probing, and NSE scripts on open ports.

naabu

Fast Go port scanner that fits the same discovery-to-scan pipeline slot.

faq

rustscan-loop questions

It takes a file of targets as the primary input so one node scans every CIDR, IP, or host in the file. Plain rustscan accepts an inline target list instead. The scanning engine underneath is the same.

related

More Network tools

  1. asnmap

    Map an organization's network ranges from ASN data.

  2. dnsvalidator

    Validate public DNS resolvers against trusted baselines.

  3. fping

    Parallel ICMP echo sweeps for CIDR ranges and host files.

  4. httprobe

    Probe a domain list for working HTTP and HTTPS servers.

  5. httpx

    A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.

  6. mapcidr

    Expand, aggregate, and slice CIDR ranges into host lists.

Run rustscan-loop yourself

A file of targets feeds RustScan Loop, which port-scans every entry and writes the open ports as a queryable output.

Open rustscan-loop in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.