masscan: internet-scale port scanning, used safely

masscan · AGPL-3.0

masscan sends its own packets rather than using the OS stack, which is why it can sweep a large address space in minutes. It answers one question — which ports are open — and answers it fast. It does not do service detection well; pair it with nmap for that.

Install

sudo apt install masscan          # Debian / Ubuntu / Kali
brew install masscan              # macOS

Building from source gets you a newer version:

git clone https://github.com/robertdavidgraham/masscan && cd masscan && make -j
sudo make install

Core commands

# a range, common ports, deliberately slow
sudo masscan 10.0.0.0/24 -p80,443,8080,8443 --rate 1000

# full TCP range
sudo masscan 10.0.0.0/24 -p0-65535 --rate 5000 -oJ masscan.json

# feed the results into nmap for version detection
sudo masscan 10.0.0.0/24 -p0-65535 --rate 1000 -oL - 
  | awk '/open/{print $4":"$3}' > open.txt

# exclude ranges you are not authorised to touch
sudo masscan 10.0.0.0/8 -p443 --rate 2000 --excludefile out-of-scope.txt

Output

{"ip":"10.0.0.14","timestamp":"1756468800","ports":[{"port":8443,"proto":"tcp","status":"open"}]}

Where it sits in Tandera

masscan runs in active_scan on recon_web_full only, after cdncheck has removed CDN and shared-provider addresses from the target set. Its role is breadth — find every open port quickly — with nmap following for depth on what it finds.

Using it in a pentest

--rate is a safety control. The default is fast enough to saturate a link and take down small targets. Start at 1000 pps, get the number agreed with the client in writing, and record it in the methodology section.

Always use --excludefile. It is the mechanism that keeps you inside the engagement when scanning CIDR blocks. Build it from your scope document before the first scan, not after the first complaint.

It reports open ports, not services. Do not write “port 8443 open” in a report. Re-scan the hits with nmap -sV and report the service and version.