R-MAS
masscan
Asynchronous, raw-packet port scanner built to sweep huge ranges at extremely high speed.
OVERVIEW
masscan (robertdavidgraham/masscan) is a port scanner designed around the same asynchronous, stateless architecture as Nmap's --min-rate scanning but taken further: it ships its own custom TCP/IP stack, bypassing the OS network stack, so it can transmit and track SYN packets at a rate limited only by the network card — the project's own benchmarks claim the entire IPv4 address space in under six minutes.
Its command-line flags are deliberately Nmap-compatible (-p, -oX, --rate) to keep the learning curve low, but it is a pure port scanner: it does not do service/version detection or NSE-style scripting the way Nmap does, so the normal workflow is running masscan first for speed and then handing the open-port list to Nmap for deeper service enumeration.
USE CASES
Practical use cases
- 01
Getting a first open-port inventory across a very large range or an entire internet-facing footprint.
- 02
Re-scanning a huge scope quickly to check whether a specific port was closed after remediation.
- 03
Feeding a fast, broad open-port list into Nmap for the slower, detailed service-version pass.
- 04
Confirming the real exposed surface of a range the client believes is smaller than it is.
QUICK START
When scope covers a very large IP range or the whole internet-facing footprint, to get a first port-open inventory faster than Nmap could manage.
- Confirm the range and the raw-packet scan rate you plan to use are both explicitly authorized — masscan's speed makes overreach easy.
- Install masscan and run it with a conservative --rate first, well below its theoretical maximum.
- Scan the target range for the relevant ports (e.g. -p80,443 or a broader set).
- Only raise --rate if the network and the client can tolerate it, checking for packet loss or complaints as you go.
- Feed the resulting open-port list into Nmap for service/version detection.
masscan -p1-65535 10.10.10.0/24 --rate 1000 -oL masscan_results.txtBEFORE YOU RUN IT
What to check before running it
Its raw-packet speed can overwhelm fragile switches, firewalls, and IDS/IPS sensors, or even saturate the link itself — always agree on a --rate ceiling with the client and start well under it, especially outside a defined maintenance window.
A high scan rate can produce inaccurate results (dropped or missed responses) on lossy networks; cross-check anything critical with a slower, more careful Nmap scan.
It only reports open ports, not service versions or vulnerabilities — treat its output as an input to further enumeration, not a finished result.