aeondave/masscan

Masscan

Ultra-fast TCP SYN scanner for large-scale port discovery.

Quick Start

masscan 10.0.0.0/16 -p445 --rate=10000 -oG out.gnmap
masscan 10.0.0.0/8 -p0-1023 --rate=50000 -oX out.xml
masscan -iL targets.txt -p80,443,8080,445 --rate=10000

Core Flags

| Flag | Purpose | |------|---------| | -p <ports> | Port list / range (e.g. 0-65535, 80,443) | | --rate <n> | Packets per second (start low) | | -oG / -oX / -oJ | Output: grepable / XML / JSON | | -iL <file> | Read targets from file | | --banners | Grab service banners | | --excludefile | Exclude IPs from scan | | --adapter-ip | Source IP | | --router-mac | Default gateway MAC |

Common Workflows

Feed results into nmap

# Discover open ports fast
masscan 10.0.0.0/24 -p1-65535 --rate=5000 -oG masscan.out

# Extract unique ports
grep "open" masscan.out | awk '{print $4}' | cut -d/ -f1 | sort -u | paste -sd, > ports.txt

# Extract unique hosts
grep "open" masscan.out | awk '{print $6}' | sort -u > hosts.txt

# Deep scan on discovered ports/hosts
nmap -sV -sC -O -p$(cat ports.txt) -iL hosts.txt -oA nmap_deep

Banner grabbing

masscan 10.0.0.0/24 -p22,80,443,445,8080 --banners --rate=1000 -oJ results.json

Config file (repeat scans)

# masscan.conf
rate = 10000
ports = 0-65535
output-format = json
output-filename = results.json
excludefile = /etc/masscan/exclude.conf

masscan 10.0.0.0/8 -c masscan.conf

Resume interrupted scan

masscan 10.0.0.0/8 -p- --rate=50000 --resume paused.conf

Rate Tuning

| Environment | Safe Rate | |-------------|-----------| | Internal lab | 10,000–100,000 | | Corporate network | 1,000–5,000 | | Internet | 10,000–1,000,000 | | Stealth | 100–500 |

• Start at --rate=1000 and increase; watch for packet loss
• Set --adapter-ip if multiple interfaces exist
• Use --router-mac if default gateway detection fails

Resources

| File | When to load | |------|--------------| | references/tuning.md | Config file options, adapter settings, exclude lists |