Skip to content
Deepak Gupta markRecon Atlas

Port scanning

MASSCAN

Asynchronous Internet-scale port scanner with nmap-like flags, its own TCP/IP stack and optional banner grabbing on common protocols.

ActiveScope a pentestAudit your own exposure

26k stars · last push October 5, 2026 · 1.3.2 · AGPL-3.0

GitHub repository

What it finds

Masscan sends SYN probes asynchronously from its own user-mode TCP/IP stack, so it can cover very large IP and port ranges fast. Its author states it can scan the whole Internet in under 5 minutes at 10 million packets per second. It can also complete connections to grab banners from protocols such as HTTP, SSH, SSL, SMB and RDP.

  • open TCP ports
  • service banners
  • SSL/TLS banner data

Does it touch the target?

Sends traffic to the target's systems. Use only with the owner's permission.

"This is an Internet-scale port scanner ... transmitting 10 million packets per second." It always runs as `-sS -Pn -n --randomize-hosts --send-eth`, sending raw SYN packets via libpcap to every address in range.

API keys: The README describes no API keys or third-party services; masscan scans targets directly.

Install

Install with source
sudo apt-get --assume-yes install git make gcc
git clone https://github.com/robertdavidgraham/masscan
cd masscan
make

From the project's documentation

Install with source
make install

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Scan port 80 and 8000-8100 on IPv4 and IPv6 ranges
masscan -p80,8000-8100 192.0.2.0/24 2001:db8::/112

From the project's documentation

Grab banners using a dedicated source IP
masscan 192.0.2.0/24 -p80 --banners --source-ip 192.168.1.200

From the project's documentation

Save results as XML
masscan 192.0.2.0/24 -p0-65535 -oX scan.xml

From the project's documentation

Re-run a scan from a saved configuration file
masscan -c myscan.conf

From the project's documentation

Output formats: xml, binary, grepable, json, list

Limits the project documents

  • Uses its own "ad hoc TCP/IP stack"; anything beyond simple port scans may conflict with the local stack unless you use `--src-ip` or firewall the `--src-port`.
  • For banner grabbing, the local OS sends RST packets that kill connections unless masscan has its own IP or a firewalled source port.
  • "no default ports to scan, you must specify -p <ports>".
  • Targets must be IP addresses or simple ranges, "not DNS names".
  • Default rate is 100 packets/second; high rates are "fast enough to melt most networks."
  • With IPv6, "your default behavior will overwhelm the target network. Networks often crash under the load that masscan can generate."
  • "Scanning the entire Internet is bad": some networks react badly and some sites add scanners to ban lists; use `--excludefile`.

Deepak's take

Analysis, not documentation

Use it when
Use it when you must check a few ports across very large address ranges you are authorised to scan, such as a full corporate allocation.
Skip it when
For hostnames, a handful of hosts, or service and OS detail, nmap or naabu fit better. Masscan takes only IP addresses and skips in-depth single-host scanning.
What it will miss
It does not resolve DNS names or identify service versions beyond simple banners, so web apps on shared IPs stay unlabelled.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Licence: AGPL-3.0. MASSCAN is a trademark or project name of its owners; this library is not affiliated with it.