GO KALI FREE

Masscan

Information Gathering

Intermediatehigh risk

Masscan is an internet-scale port scanner. It can scan the entire Internet in under 6 minutes, transmitting up to 10 million packets per second utilizing asynchronous transmit setups.

Installation

sudo apt install masscan

Basic Syntax

masscan [options] <target>

Quick Facts

Full Name
Masscan
License
AGPLv3
Author
Robert David Graham
Written In
C
Platforms
Linux, macOS
Category
Port Scanner
First Release
2013
Max Speed
10M packets/sec

Tool Overview

Masscan is the fastest internet-scale port scanner available, capable of transmitting up to 10 million packets per second. It uses asynchronous transmission to scan massive IP ranges without the overhead of maintaining TCP connection state.

Created by Robert David Graham in 2013, Masscan was designed to scan the entire IPv4 address space in under 6 minutes. It achieves this by operating at the raw packet level, sending SYN packets and analyzing responses without completing TCP handshakes.

While Masscan excels at speed, it trades off detailed analysis capabilities. It identifies open ports but does not perform service detection or OS fingerprinting. For comprehensive scanning, Masscan is typically used as a first pass to identify live hosts, followed by Nmap for deeper analysis.

Common Commands

masscan -p80,443 192.168.1.0/24 --rate 1000Network subnet scan - Quickly sweep an active internal scope target range for web operational setups
masscan 192.168.1.0/24 -p80,443Scan common web ports
masscan 10.0.0.0/8 -p0-65535 --rate 10000Full port scan
masscan 192.168.1.0/24 --top-ports 100Top 100 ports
masscan 192.168.1.0/24 -p22,3389 -oL output.txtSave results
masscan 192.168.1.0/24 -p 80,443Scan for web ports
masscan 192.168.1.0/24 -p0-65535 --rate 1000Full port scan at 1000 pps
masscan 192.168.1.0/24 -p 22 --bannersSSH banner grabbing
masscan 192.168.1.0/24 -p 80 --open-onlyShow only open ports
masscan 192.168.1.0/24 -p 80 -oL live.txtList output format
masscan 192.168.1.0/24 -p 80 -oJ results.jsonJSON output
masscan 192.168.1.0/24 -p 80 -oX results.xmlXML output
masscan 192.168.1.0/24 -p 80 -oG grep.txtGrepable output
masscan 192.168.1.0/24 -p 80 --adapter eth0Specific interface
masscan 192.168.1.0/24 -p 80 --source-port 61000Custom source port

Step-by-Step Guide

  1. 1Specify the exact IP blocks or subnets you intend to target
  2. 2Indicate the specific ports you want to test for status
  3. 3Adjust the packet transmission rate so you don't overwhelm your local connection
  4. 4Initiate the high-speed sweep
  5. 5Output the identified open ports for further script-based analysis

Warnings

Use Cases

Internet-wide Scanning

Scan the entire IPv4 address space to discover hosts and open services globally.

Large Network Discovery

Quickly map large enterprise networks with thousands of IP addresses.

Asset Inventory

Discover all open ports across entire IP ranges for asset documentation.

Port Monitoring

Monitor for new open ports appearing on your network over time.

Shadow IT Discovery

Find unauthorized services and devices on corporate networks.

Key Features

Related Tools

Nmap

Information Gathering

Detailed service detection and OS fingerprinting for hosts found by Masscan.

RustScan

Information Gathering

Modern Rust-based scanner with automatic Nmap integration.

Frequently Asked Questions

What is Masscan used for?

Masscan is an internet-scale port scanner designed for scanning massive IP ranges at extreme speeds. It can scan the entire IPv4 address space in under 6 minutes, making it ideal for large-scale network reconnaissance and asset discovery.

How fast is Masscan?

Masscan can transmit up to 10 million packets per second using asynchronous transmission. It can scan the entire IPv4 address space (all 4 billion IPs) in approximately 6 minutes at maximum speed.

Is Masscan legal?

Masscan itself is legal software, but scanning systems without authorization is illegal. Always obtain written permission before scanning networks you don't own. Masscan's speed makes unauthorized scanning particularly detectable.

Does Masscan detect services?

No, Masscan only identifies open ports. It does not perform service detection or OS fingerprinting. Use Nmap for deeper analysis of ports discovered by Masscan.

How does Masscan compare to Nmap?

Masscan is optimized for speed and can scan entire networks in seconds. Nmap provides detailed service detection, OS fingerprinting, and scripting. Use Masscan for discovery, then Nmap for deep analysis.

How do I install Masscan?

Install Masscan using: sudo apt install masscan on Kali Linux. On other systems, build from source from the GitHub repository.

How do I use Masscan to scan a subnet?

Run masscan 192.168.1.0/24 -p80,443 to scan a subnet for common web ports. Use --rate to control speed.

What are the most common Masscan commands?

Common commands include: masscan 192.168.1.0/24 --top-ports 100 (top ports), masscan 10.0.0.0/8 -p0-65535 --rate 10000 (full port scan).

How does Masscan compare to Unicornscan?

Masscan is faster and more widely used. Unicornscan offers more features but is slower and less maintained.

What is the --rate flag in Masscan?

The --rate flag controls packets per second: --rate 1000 for 1000 pps. Lower rates are safer for fragile networks.

What is the --top-ports flag?

The --top-ports flag scans the most common ports: --top-ports 100 scans the 100 most common ports.

How do I save Masscan results?

Use -oL results.txt for list format or -oJ results.json for JSON format. Results are not saved by default.

What is the -p flag in Masscan?

The -p flag specifies ports: -p80,443 for specific ports, -p0-65535 for all ports.

How do I scan all ports with Masscan?

Use -p0-65535 or --top-ports 65535 to scan all 65535 TCP ports.

Can Masscan scan UDP ports?

Masscan has limited UDP support. Use Nmap for comprehensive UDP scanning after Masscan identifies live hosts.

How long does a Masscan scan take?

At maximum speed (10M pps), Masscan scans the entire IPv4 space in ~6 minutes. For a /24 subnet, it takes seconds.

What is the risk of using Masscan?

Masscan can crash fragile devices, trigger IDS alerts, and disrupt networks. Always use --rate to limit speed and scan only authorized targets.

Tags

#scanning#network#port-scan#reconnaissance

Output Explanation

Masscan output shows discovered open ports on target systems. Results include IP address, port number, protocol, and service version when detected. Open ports indicate potential attack surfaces.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.