masscan: Scan TCP Ports at Internet Scale with Its Own TCP/IP Stack

Overview

Masscan is a C-based, asynchronous TCP port scanner built around its own ad hoc TCP/IP stack. It is designed for scanning large IP address and port ranges quickly, rather than for intensive inspection of a single host. Its command-line options and several output formats are familiar to Nmap users, while its scanning model is built for broad, high-rate probes.

The project supports Linux, Windows, macOS, and other systems, with performance depending on the platform and network hardware. It also supports IPv4 and IPv6, and can optionally establish connections to collect basic service banners. Masscan's separate network stack can conflict with the host's TCP/IP stack, so source IP or port selection and firewall configuration may be needed, especially for banner checks.

Key Features

• Asynchronously sends probes and receives responses for wide-range scans.
• Scans configurable IP address and port ranges, including IPv4 and IPv6 targets.
• Randomizes probe order to spread traffic across target addresses.
• Supports sharding scans across multiple machines, adapters, or source addresses.
• Offers optional banner checks for protocols including HTTP, SSH, FTP, and SMB.
• Writes results as XML, binary, grepable text, JSON, or a simple host-and-port list.
• Provides Nmap-like command-line options and configuration files.
• Includes a built-in self-test and regression test target.

Use Cases

• Network and security teams can inventory exposed ports across large address ranges they are authorized to assess.
• Researchers can run broad, controlled measurements of reachable services, using exclusions and a deliberate transmit rate.
• Operators can schedule repeat scans from saved configuration files and compare or process results in their existing tooling.
• Teams that need service identification can enable banner checks on selected targets, after accounting for the separate TCP/IP stack.

Getting Started

On Debian or Ubuntu, install the compiler and build tools, then build from source:

sudo apt-get install git make gcc
 git clone https://github.com/robertdavidgraham/masscan
cd masscan
make

See the README for platform-specific build guidance, scan options, and network configuration details. Only scan systems and networks you are authorized to assess.

Alternatives

• RustScan: RustScan is a Rust-based port scanner that can hand discovered ports to Nmap, while masscan uses its own TCP/IP stack for high-speed large-range scans.

Considerations

Masscan can transmit probes at very high rates, and the README warns that traffic can overwhelm networks, particularly when scanning a focused IPv6 subnet. Start with a conservative rate, use exclusions where appropriate, and plan scans to avoid disrupting target networks. Its own TCP/IP stack may conflict with the operating system's stack; banner checks can require a separate source IP or firewall rules. The project has recent commits and is marked maintained, but has had no release in over a year, and most of the code comes from one person. It is licensed under AGPL-3.0.