masscan(1)
masscan is an asynchronous TCP port scanner designed to scan the entire Internet quickly.
Synopsis
masscan <ip/range> [OPTIONS]Description
masscan is a high-speed port scanner that can transmit 10 million packets per second on a gigabit connection. It uses asynchronous transmission to scan large IP ranges far faster than traditional tools like nmap, making it ideal for Internet-wide reconnaissance and large-scale network surveys.
masscan operates at the network layer using raw sockets and requires root privileges. It can scan individual ports or ranges, and supports various output formats for integration with other tools. The trade-off for speed is that masscan is less feature-rich than nmap and doesn't perform service version detection.
Common options
| Flag | What it does |
|---|---|
-p <ports> | ports to scan; examples: 80, 80,443, 20-25, 0-65535 |
-r <rate> | transmission rate in packets per second (default: 100) |
-e <iface> | network interface to use for scanning |
--router-ip <ip> | IP address of local router/gateway |
-o <filename> | write output to file |
--output-format <fmt> | output format: xml, json, binary, list, greppable (default: xml) |
--wait <seconds> | seconds to wait for responses after scan completes (default: 10) |
--excludefile <file> | read exclude list from file (one IP/range per line) |
-c <config> | read options from configuration file |
--randomize | randomize order of IP addresses being scanned |
Examples
scan a /24 subnet for web ports at 1000 packets/second
sudo masscan 192.168.1.0/24 -p 80,443 -r 1000Internet-wide scan for SSH port (very slow due to data volume), output as JSON
sudo masscan 0.0.0.0/0 -p 22 -r 100000 --output-format json -o ssh_scan.jsonfull port scan of private range with specified network interface and gateway
sudo masscan 10.0.0.0/8 -p 0-65535 -e eth0 --router-ip 10.0.0.1scan for MySQL port while excluding IPs listed in exclude.txt file
sudo masscan 203.0.113.0/24 -p 3306 --excludefile exclude.txt -r 5000randomized scan for SMB port with simple line-based output format
sudo masscan 192.168.0.0/16 -p 445 --randomize -r 2000 --output-format listscan for HTTP with extended wait time for slow responses, save XML output
sudo masscan 198.51.100.0/24 -p 80 -r 10000 --wait 30 -o web_servers.xml