Masscan
Ultra-fast TCP SYN scanner for large-scale port discovery.
Quick Start
masscan 10.0.0.0/16 -p445 --rate=10000 -oG out.gnmap
masscan 10.0.0.0/8 -p0-1023 --rate=50000 -oX out.xml
masscan -iL targets.txt -p80,443,8080,445 --rate=10000
Core Flags
| Flag |
Purpose |
-p <ports> |
Port list / range (e.g. 0-65535, 80,443) |
--rate <n> |
Packets per second (start low) |
-oG / -oX / -oJ |
Output: grepable / XML / JSON |
-iL <file> |
Read targets from file |
--banners |
Grab service banners |
--excludefile |
Exclude IPs from scan |
--adapter-ip |
Source IP |
--router-mac |
Default gateway MAC |
Common Workflows
Feed results into nmap
# Discover open ports fast
masscan 10.0.0.0/24 -p1-65535 --rate=5000 -oG masscan.out
# Extract unique ports
grep "open" masscan.out | awk '{print $4}' | cut -d/ -f1 | sort -u | paste -sd, > ports.txt
# Extract unique hosts
grep "open" masscan.out | awk '{print $6}' | sort -u > hosts.txt
# Deep scan on discovered ports/hosts
nmap -sV -sC -O -p$(cat ports.txt) -iL hosts.txt -oA nmap_deep
Banner grabbing
masscan 10.0.0.0/24 -p22,80,443,445,8080 --banners --rate=1000 -oJ results.json
Config file (repeat scans)
# masscan.conf
rate = 10000
ports = 0-65535
output-format = json
output-filename = results.json
excludefile = /etc/masscan/exclude.conf
masscan 10.0.0.0/8 -c masscan.conf
Resume interrupted scan
masscan 10.0.0.0/8 -p- --rate=50000 --resume paused.conf
Rate Tuning
| Environment |
Safe Rate |
| Internal lab |
10,000–100,000 |
| Corporate network |
1,000–5,000 |
| Internet |
10,000–1,000,000 |
| Stealth |
100–500 |
- Start at
--rate=1000 and increase; watch for packet loss
- Set
--adapter-ip if multiple interfaces exist
- Use
--router-mac if default gateway detection fails
Resources
| File |
When to load |
references/tuning.md |
Config file options, adapter settings, exclude lists |
AeonDave