security enabled verified medium v1.0.0

masscan

High-speed TCP port scanner capable of scanning the entire internet in minutes, supporting banner grab, configurable rate limits, and multiple output formats.

📋 Live Preview 
masscan {target} -p{ports} --rate={rate}
🌍 target → ip 🌍 ports → 80,443 🌍 rate → 10000 
masscan {target} -p{ports} --rate={rate}

Sandbox: execFile · Timeout: 600s

Capabilities

network.scan.port
network.discovery.host
security.fingerprint.service
security.evasion.firewall
network.scan.banner

Parameters

Name Type Required Default Description Aliases
flag-p string No - Ports to scan (e.g. -p80, -p1-65535) -p, --ports
rate integer No 100 Packets per second (default 100) --rate
flag-oJ string No - Output to JSON file -oJ, --output-json
flag-oX string No - Output to XML file -oX, --output-xml
flag-oB string No - Output to binary file -oB, --output-binary
adapter-ip string No - IP address of the network adapter --adapter-ip
adapter-port string No - Source port for outgoing packets --adapter-port
adapter-mac string No - MAC address of the network adapter --adapter-mac
router-mac string No - MAC address of the gateway router --router-mac
exclude string No - IP addresses to exclude from scan --exclude
excludefile file No - File with IPs to exclude --excludefile
banners boolean No - Grab banners from open ports --banners
nmap boolean No - List options compatible with nmap --nmap

Artifacts

TypeDescriptionMIMESchemaTrust
network.scan.binaryBinary scan results for later processingapplication/octet-stream-verified
network.scan.xmlXML-formatted scan resultsapplication/xml-verified
network.scan.jsonJSON-formatted scan resultsapplication/json-verified

Contract

Inputs

network.target.ip

Target IP address or CIDR range

network.target.range

IP range in CIDR notation

network.port.range

Port range or comma-separated ports

Outputs

network.scan.json

Scan results as JSON

network.scan.xml

Scan results as XML

Side effects: network_trafficraw_socket_access

Workflow Edges

Produces

network.scan.jsonnetwork.scan.xml

Consumes

network.target.ipnetwork.target.rangenetwork.port.range

Resource Profile

ResourceValue
CPUmedium
Memory64 MB
Networkhigh
Disk I/Olow

Examples

Scan a subnet for web servers

masscan 10.0.0.0/8 -p80,443 --rate=10000

Scan specific IP for all ports with banners

masscan 192.168.1.1 -p1-65535 --banners --rate=1000

Output results to JSON file

masscan 10.0.0.0/24 -p22,80,443 -oJ scan.json --rate=1000

Scan with custom adapter settings

masscan 10.0.0.0/8 -p80 --adapter-ip 192.168.1.100 --adapter-mac 00-11-22-33-44-55 --router-mac 66-55-44-33-22-11

Exclude specific IPs from a range scan

masscan 10.0.0.0/8 -p443 --exclude 10.0.0.1 --rate=10000

Binary output for later reprocessing

masscan 10.0.0.0/8 -p80,443 --banners -oB session.scan --rate=10000

Read binary scan results and convert to XML

masscan --open --banners --readscan session.scan -oX results.xml

List nmap-compatible options

masscan --nmap

Documentation

Masscan — High-Speed Port Scanner

Masscan is the fastest TCP port scanner available, capable of scanning the entire internet in about 5 minutes when sent at 10 million packets per second. It uses asynchronous transmission similar to nmap -sS but with a custom TCP/IP stack for maximum performance.

Key Features

  • Massively parallel: Scans the entire IPv4 internet in minutes
  • Banner grab: Captures service banners from open ports
  • Multiple output formats: Binary, XML, JSON, grepable
  • Nmap compatibility: Many options mirror nmap syntax
  • Config file support: Save and reuse scan configurations

Basic Scan Types

Scan Type Command Description
Single port masscan target -p80 Scan a single port on target
Port range masscan target -p1-65535 Scan all 65535 ports
Multiple ports masscan target -p22,80,443,8080 Scan specific ports
CIDR range masscan 10.0.0.0/8 -p443 Scan an entire subnet
With banners masscan target -p80 --banners Grab service banners

Output Formats

# Binary (compact, for later reprocessing)
masscan target -p80 -oB session.scan

# XML (machine-parseable)
masscan target -p80 -oX scan.xml

# JSON (structured)
masscan target -p80 -oJ scan.json

# Grepable (text)
masscan target -p80 > scan.txt

Performance Tuning

  • --rate=100000 — target 100,000 packets per second (default: 100)
  • --adapter-ip — specify source IP for load balancing across interfaces
  • --shard N/M — split scan across M machines (this is shard N)

Operational Security

  • Masscan generates extremely high network traffic; use rate limiting responsibly
  • Root privileges are required for SYN scans
  • Scanning without authorization is illegal in many jurisdictions
  • Use --excludefile to avoid scanning sensitive IP ranges

Related Tools

nmaprustscanzenmap

References