# masscan: internet-scale port scanning, used safely

> How to install and run masscan, why rate limiting is a safety control rather than a tuning knob, and how Tandera pairs it with nmap.

`masscan` sends its own packets rather than using the OS stack, which is why it can sweep a large address space in minutes. It answers one question — which ports are open — and answers it fast. It does not do service detection well; pair it with `nmap` for that.

## Install

```bash
sudo apt install masscan          # Debian / Ubuntu / Kali
brew install masscan              # macOS
```

Building from source gets you a newer version:

```bash
git clone https://github.com/robertdavidgraham/masscan && cd masscan && make -j
sudo make install
```

## Core commands

```bash
# a range, common ports, deliberately slow
sudo masscan 10.0.0.0/24 -p80,443,8080,8443 --rate 1000

# full TCP range
sudo masscan 10.0.0.0/24 -p0-65535 --rate 5000 -oJ masscan.json

# feed the results into nmap for version detection
sudo masscan 10.0.0.0/24 -p0-65535 --rate 1000 -oL - \
  | awk '/open/{print $4":"$3}' > open.txt

# exclude ranges you are not authorised to touch
sudo masscan 10.0.0.0/8 -p443 --rate 2000 --excludefile out-of-scope.txt
```

## Output

```json
{"ip":"10.0.0.14","timestamp":"1756468800","ports":[{"port":8443,"proto":"tcp","status":"open"}]}
```

## Where it sits in Tandera

masscan runs in **active_scan** on `recon_web_full` only, after `cdncheck` has removed CDN and shared-provider addresses from the target set. Its role is breadth — find every open port quickly — with `nmap` following for depth on what it finds.

## Using it in a pentest

**`--rate` is a safety control.** The default is fast enough to saturate a link and take down small targets. Start at 1000 pps, get the number agreed with the client in writing, and record it in the methodology section.

**Always use `--excludefile`.** It is the mechanism that keeps you inside the engagement when scanning CIDR blocks. Build it from your scope document before the first scan, not after the first complaint.

**It reports open ports, not services.** Do not write "port 8443 open" in a report. Re-scan the hits with `nmap -sV` and report the service and version.

---

Canonical: https://tandera.io/tools/masscan
This page as markdown: https://tandera.io/tools/masscan.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.